@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

CVE-2026-85184 affects @fastify/middie versions 9.1.0 through 9.3.3 and is fixed in 9.3.4. The vulnerability exploits an interpretation conflict (CWE-436) between middie's middleware path-matching logic and Fastify's core router. In HTTP/1.1, a client can send a request using *absolute-form* — e.g., GET http://target.com/admin/secret HTTP/1.1 instead of the typical origin-form GET /admin/secret HTTP/1.1. Node.js's http module faithfully preserves the absolute-form URI in req.url. Middie's path-scoped middleware checks if req.url starts with a registered prefix like /admin, but http://target.com/admin/secret doesn't match that check — so authentication, authorization, rate-limiting, and audit middleware are silently skipped. Fastify's router, however, normalizes the request target and routes it to the correct handler, granting the attacker unauthenticated access to protected endpoints.

The vendor scored this CRITICAL at 9.1 (AV:N/AC:L/PR:N/UI:N), and on paper the vector is accurate — it's unauthenticated, network-reachable, and low-complexity. But the vendor score ignores a decisive real-world friction point: virtually all production Fastify deployments sit behind a reverse proxy (Nginx, HAProxy, AWS ALB, Cloudflare, Traefik, Envoy) that normalizes absolute-form request targets to origin-form before forwarding traffic to the Node.js backend. This means the malicious request never reaches middie in its exploitable shape for the majority of deployments. The CRITICAL rating overstates practical risk for enterprises running standard ingress architectures, though the minority of deployments with direct Node.js exposure face genuine, trivially exploitable auth bypass.

Why this verdict

• Reverse-proxy friction is decisive. Nginx, HAProxy, AWS ALB, Cloudflare, Traefik, and Envoy all normalize absolute-form request targets to origin-form before forwarding — this breaks the attack chain for the majority of production deployments without any deliberate mitigation.
• No authentication required, trivial complexity. For the minority of directly-exposed deployments, exploitation requires nothing more than curl --request-target — no credentials, no user interaction, no race conditions. This prevents downgrade below HIGH.
• Idiomatic Fastify reduces blast radius further. The Fastify ecosystem encourages preHandler hooks over Express-style middleware. Only applications that specifically use app.use('/path', middleware) via @fastify/middie for security controls are affected — apps using Fastify-native hooks are immune.
• Role multiplier: @fastify/middie is a web application framework plugin, not canonically a high-value infrastructure component (not an IdP, hypervisor, DC, CA, backup server, or network edge). The blast radius is application-scoped — confidentiality and integrity of whatever the specific Fastify app manages. In the rare case where a Fastify app serves as an API gateway or auth service, the impact escalates to tenant-scale, but this represents a small fraction of the installed base. No floor elevation triggered.
• Sixth bypass in the same codebase in 2026. The pattern of repeated canonicalization failures in @fastify/middie (URL encoding, double slashes, child scope prefixing, %2F in params, deprecated options, now absolute-form) suggests further variants are likely. This systemic risk argues against downgrading to MEDIUM.

Why not higher?

The vendor's CRITICAL rating assumes all deployments are directly reachable, which ignores the dominant deployment pattern. Reverse proxies normalize absolute-form URIs before they reach Node.js, neutering the attack for the majority of installs. There is no KEV listing, no active exploitation, and the blast radius is application-scoped rather than fleet-scale or identity-scale.

Why not lower?

The bypass is unauthenticated, zero-click, and trivially exploitable against directly-exposed Node.js instances — a population that, while a minority, is non-negligible (dev/staging environments, microservice meshes without ingress normalization, serverless platforms with direct routing). The repeated pattern of bypasses in this codebase also signals that compensating controls may be needed even if patched, preventing a MEDIUM verdict.

1. Confirm a normalizing reverse proxy sits in front of every Fastify instance — Nginx, HAProxy, AWS ALB, Cloudflare, Traefik, and Envoy all rewrite absolute-form request targets to origin-form before forwarding. Verify this is in place for all environments (including staging and dev) — this single control neutralizes the attack. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Migrate security middleware from middie to Fastify-native preHandler hooks — Fastify's preHandler hooks execute after routing, so they are immune to request-target normalization mismatches. Replacing app.use('/path', authMiddleware) with fastify.addHook('preHandler', authFn) eliminates the entire class of middie path-matching bypasses — including future variants. This is the most durable fix.
3. Add WAF/IDS rule to block absolute-form request lines — Create a rule matching ^(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS) https?:// in the HTTP request line. This is a low-false-positive signature since browsers and standard clients never generate absolute-form requests to origin servers (only to forward proxies).
4. Upgrade to @fastify/middie ≥9.3.4 — The definitive fix. Run npm install @fastify/[email protected] or update your lockfile. Test middleware behavior with absolute-form requests in CI before deploying.

Run this on any machine with npm and network access to your application's package source (e.g., a CI runner or the app host itself). Invoke with: bash check_middie.sh /path/to/your/app. No special privileges required — it reads node_modules only.

#!/usr/bin/env bash
# check_middie.sh — Detect CVE-2026-85184 (@fastify/middie absolute-form bypass)
# Usage: bash check_middie.sh /path/to/app
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

APP_DIR="${1:-.}"
PKG_JSON="$APP_DIR/node_modules/@fastify/middie/package.json"

if [ ! -f "$PKG_JSON" ]; then
  echo "UNKNOWN — @fastify/middie not found in $APP_DIR/node_modules"
  exit 2
fi

VERSION=$(node -e "console.log(require('$PKG_JSON').version)" 2>/dev/null)
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse version from $PKG_JSON"
  exit 2
fi

echo "Detected @fastify/middie version: $VERSION"

# Compare version using node semver logic
RESULT=$(node -e "
  const v = '$VERSION';
  const parts = v.split('.').map(Number);
  const [major, minor, patch] = parts;
  // Affected: >=9.1.0 and <9.3.4
  if (major < 9 || (major === 9 && minor < 1)) {
    console.log('NOT_AFFECTED');  // below affected range
  } else if (major === 9 && (minor < 3 || (minor === 3 && patch < 4))) {
    console.log('VULNERABLE');
  } else if (major >= 9) {
    console.log('PATCHED');
  } else {
    console.log('UNKNOWN');
  }
" 2>/dev/null)

case "$RESULT" in
  VULNERABLE)
    echo "VULNERABLE — @fastify/middie $VERSION is affected by CVE-2026-85184"
    echo "  Upgrade to >=9.3.4: npm install @fastify/[email protected]"
    exit 1
    ;;
  PATCHED)
    echo "PATCHED — @fastify/middie $VERSION is not affected"
    exit 0
    ;;
  NOT_AFFECTED)
    echo "PATCHED — @fastify/middie $VERSION predates the affected range (9.1.0–9.3.3)"
    exit 0
    ;;
  *)
    echo "UNKNOWN — could not determine status for version $VERSION"
    exit 2
    ;;
esac

Sources

1. GitHub Advisory — GHSA-hx87-8wv7-pjv8 (CVE-2026-85184)
2. @fastify/middie npm package
3. GHSA-72c6-fx6q-fr5w — CVE-2026-6270 child scope bypass
4. GHSA-2v46-jxjm-7q3v — CVE-2026-14198 encoded slash bypass
5. GHSA-v9ww-2j6r-98q6 — CVE-2026-33804 duplicate slash bypass
6. GHSA-cxrg-g7r8-w69p — CVE-2026-22031 URL encoding bypass
7. Node.js absolute-form request handling research
8. SentinelOne — CVE-2026-14198 analysis