{"type":"bundle","id":"bundle--1fa9feb4-1705-550c-b492-6b1938da1f24","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--704bce3a-c7e3-5438-a43a-7d97e84f2ccc","created":"2026-09-20T19:37:33.351Z","modified":"2026-09-20T19:37:33.351Z","name":"Fastify middie absolute-form requests can skip auth","description":"@fastify/middie before 9.3.4 allows absolute-form requests to skip path-scoped middleware auth. Upgrade to 9.3.4.","aliases":["CVE-2026-85184","@fastify/middie absolute-form bypass"],"first_seen":"2026-09-04T00:00:00.000Z","last_seen":"2026-09-04T12:00:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GitHub Security Advisory GHSA-hx87-8wv7-pjv8","url":"https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8"},{"source_name":"NVD CVE-2026-85184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85184"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-85184-fastify-middie-absolute-form-middleware-bypass"}]}]}