CVE-2026-85184

Executive Summary

CVE-2026-85184 is an interpretation-conflict vulnerability (CWE-436) in the @fastify/middie middleware engine, versions 9.1.0 through 9.3.3, used inside Fastify web applications. The plugin matches path-scoped middleware (such as authentication or authorization guards) against the raw request target, while the underlying Fastify router first normalizes absolute-form request targets to their path component before dispatching. This mismatch allows an unauthenticated network attacker to craft a request that reaches a protected route handler while the associated path-scoped middleware is silently skipped.

Because the bypass defeats path-based access controls, any Fastify application relying on middie for authentication or authorization enforcement may expose protected endpoints to anonymous users. The CVSS v3.1 base score is 9.1 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — reflecting trivial remote exploitation, no privileges required, and a high impact on confidentiality and integrity. No public proof-of-concept, exploit code, or Nuclei template currently exists, and the CVE is not listed in CISA KEV. EPSS is 0.00316 (24.5th percentile), indicating low but non-zero predicted exploitation activity. A fixed release is available in @fastify/middie 9.3.4.

Technical Analysis

Root Cause: Divergent String Interpretation (CWE-436)

CWE-436 ("Interpretation Conflict") describes scenarios where two distinct components of a system parse the same input differently, producing inconsistent decision outcomes. In this CVE, two cooperating layers inside the Fastify request pipeline disagree on what the effective request path is:

1. @fastify/middie performs path-scoping by matching a request's path against middleware mounting prefixes. According to the NVD description, the vulnerable versions (>= 9.1.0 and < 9.3.4) match against the raw request target as it arrives on the wire.
2. The Fastify router resolves an absolute-form request target to its path component before dispatching to a route handler. Per RFC 7230 / RFC 9112, an HTTP request target may take the "absolute-form" — e.g., GET http://example.com/admin HTTP/1.1 — as opposed to the common "origin-form" GET /admin HTTP/1.1.

When an attacker submits an absolute-form target, the strings the two layers operate on diverge:

• Fastify's router normalizes http://example.com/admin → /admin and routes to the /admin handler.
• @fastify/middie evaluates the raw target string (http://example.com/admin) against its middleware path scope (e.g., /admin). Since the raw string does not start with the middleware's expected prefix, the middleware's condition evaluates false and the middleware is not executed.

The net result is a middleware/route mismatch: the handler runs, but the guard does not. The security decision and the dispatch decision are made on different representations of the same request, and the attacker controls which representation wins.

Why Authentication Is Skipable

Path-scoped middleware is the common Fastify pattern for attaching guards to a route subtree — for example, mounting an authentication check on /admin and an authorization check on /api/private. When middie misclassifies the request's path scope, those guards never run for the crafted request. The route handler itself, however, is selected by the router's corrected path. This means:

• The request is authenticated as anonymous (no guard executed).
• The handler for the protected path nevertheless executes with whatever the application assumes about the caller.

A well-built handler may still perform its own session checks, but Fastify applications that centralize authentication at the middleware layer are fully bypassed. There is no data-level integrity check in the framework that would detect the missing middleware execution.

Exposure Requirements

Exploitation requires the following conditions, all derivable from the description:

1. A Fastify application using @fastify/middie version >= 9.1.0 and < 9.3.4.
2. At least one protected route whose access control is implemented as path-scoped middleware registered through middie.
3. The route must be reachable by an unauthenticated network attacker (AV:N).
4. The attacker must be able to send a request using an absolute-form request target.

No user interaction (UI:N) and no prior privileges (PR:N) are required. Attack complexity is low (AC:L): the attacker only needs to change the request target representation, not defeat a cryptographic or logic challenge.

Version Boundary Detail

The affected range begins at 9.1.0 — releases before 9.1.0 are believed not to contain the divergent-matching behavior — and ends before 9.3.4, where the fix landed. The single authoritative remediation is to upgrade to 9.3.4 or later. The OSV package record provided (8de54e35035cefa5ca13fd9f06c7b38185038a0e) shows the fixed state ("unfixed" in the OSV snapshot at the time of extraction, resolved by the 9.3.4 release per NVD).

Precise Technical Detail Limitation

The NVD description does not disclose internal function names, the specific comparison routine, whether the fix normalized both sides to origin-form, or whether additional request-target forms (e.g., authority-form) are also affected. This report deliberately avoids inventing those details. The vulnerability class — interpretation conflict between middleware path matching and router path resolution — is fully described, and that is sufficient to reason about exploitation and detection.

Exploitation Scenarios

Note on PoC status: No public PoC, exploit code, or Nuclei template is available for CVE-2026-85184. The attack chain below is inferred from the vulnerability class (CWE-436 interpretation conflict) and the mechanics stated verbatim in the NVD description. No specific function names, endpoints, or parameters beyond those in the description are asserted.

1) Reconnaissance / Target Identification

An attacker first identifies candidate Fastify applications. Fastify-powered services frequently expose identifying headers or behavior; @fastify/middie is used in applications that need Express-style middleware semantics alongside Fastify routing. Because the flaw is in a widely deployed plugin, the attacker's practical reconnaissance is:

• Enumerate HTTP services and fingerprint server frameworks.
• Probe for paths that are evidently protected — endpoints that return 401/403 on normal (origin-form) requests strongly suggest a path-scoped guard is mounted there. These are the highest-value targets, because a guard that can be observed is a guard that can potentially be skipped.

2) Triggering the Flaw

The attacker crafts an HTTP request whose request target is in absolute-form rather than origin-form, targeting the path of a protected route. In origin-form the request would look like:

GET /admin/endpoint HTTP/1.1
Host: target.example.com

The crafted, absolute-form variant embeds the scheme and authority into the request target:

GET http://target.example.com/admin/endpoint HTTP/1.1
Host: target.example.com

Per the NVD description, Fastify's router will resolve http://target.example.com/admin/endpoint to its path (/admin/endpoint) and dispatch to the intended route handler. @fastify/middie, evaluating the raw request target against its path scope, will not match the middleware for /admin (or whatever prefix is used) because the raw string begins with the scheme and authority. The guard therefore does not run, but the handler does.

3) Execution Method (Vulnerability-Class Level)

The "payload" for this class is purely the request-target representation. There is no injection string, no buffer overflow, no deserialization payload. The attacker's entire action is to alter how the request line encodes the target so that the middleware's matcher and the router's resolver disagree. This makes the exploit:

• Highly repeatable — the same request structure can be replayed against any protected path.
• Low-noise — the only observable difference is the request-target form, which many logging pipelines normalize or truncate.
• Framework-level — the flaw exists in the plugin, not in the application, so a single vulnerable dependency version exposes every guarded route the application defines.

4) Post-Exploitation Impact

Once a protected handler executes without its middleware guard:

• Confidentiality (C:H): read actions on protected resources succeed as anonymous. Administrative dashboards, user data, configuration, and internal API responses normally gated by the skipped middleware become readable.
• Integrity (I:H): write actions on protected resources succeed as anonymous — state changes, record modification, and any mutation the handler performs proceed without the authorization check the guard was supposed to enforce.
• Availability (A:N): the CVSS vector rates availability impact as None; the flaw itself does not imply denial of service.

The attacker can chain the bypass with legitimate handler functionality to perform authorized-looking privileged operations, making attribution and forensic reconstruction difficult. There is no evidence in the provided data of in-the-wild exploitation or of use by a named threat actor; CISA KEV does not list this CVE.

Impact Assessment

CVSS v3.1 Interpretation

Base score 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

• AV:N (Network): the vulnerable Fastify application is reachable over the network; no local access is needed.
• AC:L (Low): no special conditions, race, or knowledge beyond the request-target form; exploit success is deterministic.
• PR:N (None): the attacker requires no credentials — indeed the bypass removes the need for them.
• UI:N (None): no victim action is required.
• S:U (Unchanged): the impact stays within the application's security scope; the flaw affects the application's own enforcement, not a downstream authority.
• C:H / I:H: protected read and write operations become anonymous, representing complete loss of the access control the middleware was meant to provide.
• A:N: no availability impact is implied.

Business Impact

Any organization running a Fastify application that depends on @fastify/middie (>= 9.1.0, < 9.3.4) for access control has effectively no enforcement on its path-scoped routes against a knowledgeable attacker. This is likely to include internal administrative panels, private APIs, multi-tenant endpoints, and any route where the guard, not the handler, is the authentication boundary. Because the bypass leaves no obvious error state (the request succeeds normally), the exploitation is subtle and may go unnoticed.

Blast Radius

• Single dependency, broad surface: one vulnerable plugin version affects every route the application scopes with it.
• Supply-chain reach: as a public npm package consumed transitively by many Fastify applications, a single fix must be propagated through the full dependency tree. The OSV record confirms this is tracked as a package-level advisory.
• Not internet-facing only: the flaw also affects internal services reachable by lateral movement, but the primary risk (AV:N) is external exposure.

Detection Guidance

Detection for this CVE relies on identifying absolute-form HTTP request targets sent to Fastify applications, since that representation is the mechanism of the bypass. Because no public PoC exists, the rules below target the mechanism (absolute-form request line) rather than a known payload. Analysts should baseline normal traffic first to control false positives, since legitimate proxies occasionally issue absolute-form requests.

Sigma Rule

title: Fastify Middie Access-Control Bypass via Absolute-Form Request Target (CVE-2026-85184)
id: 8a2f1d44-6c3b-4c9e-9f21-7b0e5d3a91cc
status: experimental
description: >
  Detects HTTP requests using absolute-form request targets (scheme://authority/path)
  reaching Fastify applications, which can bypass path-scoped @fastify/middie
  authentication/authorization guards in versions >= 9.1.0 and < 9.3.4.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85184
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_absform:
    cs-uri-stem|re: '^https?://[^/]+/'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
      - 'HEAD'
  condition: selection_absform and selection_method
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs(User-Agent)
falsepositives:
  - Legitimate forward proxies issuing absolute-form requests
  - Health checks or API clients misconfigured to send full URLs
level: high
tags:
  - attack.t1190
  - cve.2026.85184

YARA Rule

rule CVE_2026_85184_Fastify_Middie_AbsoluteForm_Bypass
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects absolute-form HTTP request targets associated with the @fastify/middie access-control bypass (CVE-2026-85184). Use on HTTP transaction logs or pcap-derived buffers."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85184"
        cve = "CVE-2026-85184"
        date = "2026-01-01"

    strings:
        $req_get  = /GET\s+https?:\/\/[^\s]+\s+HTTP\/1\.[01]/
        $req_post = /POST\s+https?:\/\/[^\s]+\s+HTTP\/1\.[01]/
        $req_put  = /PUT\s+https?:\/\/[^\s]+\s+HTTP\/1\.[01]/
        $req_del  = /DELETE\s+https?:\/\/[^\s]+\s+HTTP\/1\.[01]/
        $host_hdr = "Host:"

    condition:
        any of ($req_*) and $host_hdr
}

Suricata IDS Rule

alert http any any -> any any ( \
  msg:"CVE-2026-85184 Fastify @fastify/middie Access-Control Bypass via Absolute-Form Request Target"; \
  flow:established,to_server; \
  http.request_line; content:"http://"; nocase; offset:0; \
  pcre:"/^(GET|POST|PUT|PATCH|DELETE|HEAD)\s+https?:\/\/[^\/\s]+\//i"; \
  classtype:attempted-admin; \
  reference:cve,2026-85184; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85184; \
  sid:202685184; rev:1; )

Note: the http.request_line sticky buffer and the offset-0 content match are used to restrict detection to the request line rather than URL-bearing headers. Deploy in alert mode first and baseline before enabling blocking, as forward proxies and some clients legitimately emit absolute-form targets.

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.transport == "tcp"
      and destination.port in (80, 443, 8080, 8443)
      and url.path != null ]
| where starts_with(url.original, "http://") or starts_with(url.original, "https://")

Interpretation: EQL is a sequence/event language; the above is expressed for a network/HTTP event source where the original request target is preserved in url.original. In environments where absolute-form targets are not retained, this rule will not fire — analysts should ensure proxy and application logs preserve the raw request line. For Elastic SIEM query DSL, the equivalent filter is:

event.category:network AND destination.port:(80 or 443 or 8080 or 8443) AND url.original:(http\://* or https\://*)

Splunk SPL Query

index=* sourcetype IN ("nginx:access","apache:access","http:access","stream:http")
| eval raw_target = coalesce(cs_uri_stem, uri_path, url, request)
| where match(raw_target, "(?i)^https?://[^/]+/")
| eval cve = "CVE-2026-85184"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(raw_target) as targets
        by src_ip, dest_ip, http_method
| where count > 0
| sort - count

Note: field names (cs_uri_stem, uri_path, url) vary by sourcetype; the coalesce accommodates that. stream:http (Splunk Stream) can expose the raw request target from packet capture, which is the most reliable source for absolute-form detection since many web servers normalize target paths before logging.

Wazuh OSSEC Rule

<group name="web,attack,cve-2026-85184,">
  <rule id="202685184" level="12">
    <if_sid>31100,31101,31108,31151</if_sid>
    <regex type="pcre2">(?:GET|POST|PUT|PATCH|DELETE|HEAD)\s+https?://[^\s/]+/</regex>
    <description>CVE-2026-85184: Fastify @fastify/middie access-control bypass - absolute-form HTTP request target detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85184,access_control_bypass,</group>
  </rule>
</group>

Note: the parent SID set (31100, 31101, 31108, 31151) belongs to the standard web-server decoder family; verify these SIDs match the Wazuh version in use, as decoder SIDs are version-specific. Match the raw request line from the web server access log or Wazuh's HTTP decoder.

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix; sources: NVD, OSV). No vendor advisory text and no formal workaround were provided; the single authoritative remediation is the version upgrade.

1) Immediate Mitigations (Patch Cannot Be Applied Right Away)

• Upgrade is strongly preferred. If instant upgrade is impossible, apply compensating controls at the edge:
  • Reject absolute-form request targets at the reverse proxy / WAF. Normal clients use origin-form (GET /path HTTP/1.1). Configure the edge to reject any request line beginning with a scheme (http:// or https://). This directly removes the bypass mechanism without touching the application.
  • Enforce access control inside the route handler as a stopgap, in addition to middleware — do not rely solely on path-scoped middleware for critical authorization decisions until the upgrade is complete.
• Reduce exposure: place affected services behind an authentication layer that operates independently of middie (e.g., an authenticating reverse proxy or mTLS) so that a skipped path-scoped middleware is not the only enforcement point.

2) Patch / Upgrade Steps

1. Identify all Fastify applications with a dependency on @fastify/middie in the range >= 9.1.0 and < 9.3.4.
2. Upgrade the plugin to 9.3.4 or later:
   • Direct dependencies: update the version constraint in package.json and reinstall.
   • Transitive dependencies: run npm ls @fastify/middie (or the equivalent for your package manager) to enumerate nested copies, then use overrides / resolutions to force 9.3.4+ where a direct upgrade is not possible.
3. Regenerate the lockfile and rebuild container images so pinned layers do not retain the vulnerable version.
4. Verify post-upgrade: npm ls @fastify/middie should show no version below 9.3.4.
5. Re-run authorization regression tests, specifically confirming that absolute-form requests to protected paths are now blocked or guarded.

3) Long-Term Hardening

• Do not centralize critical authorization solely at the middleware layer. Defense in depth: keep a handler-level authorization assertion for sensitive operations so a single middleware misconfiguration or bypass cannot expose the resource.
• Add absolute-form rejection to the edge baseline as a permanent input-validation policy rather than a one-off mitigation.
• Maintain dependency hygiene: enable automated vulnerability alerts (e.g., npm audit, OSV scanning, Dependabot) and monitor Fastify security advisories for the @fastify/middie package.
• Baseline and alert on request-target form in web server and proxy logs, as described in the Detection Guidance section, to surface future variant bypasses.
• Track EPSS for this CVE. At 0.00316 (24.5th percentile) exploitation is unlikely in the near term, but it is not zero; monitor for a change and monitor CISA KEV for future listing.

References

1. NVD — CVE-2026-85184: https://nvd.nist.gov/vuln/detail/CVE-2026-85184
2. OSV Advisory (package tracking for @fastify/middie): https://osv.dev/ — search package @fastify/middie; the OSV record associated with this CVE tracks the affected/fixed version boundary.
3. Fastify / @fastify/middie project repository and security advisories: https://github.com/fastify/middie — consult the repository's releases and advisory history for the 9.3.4 fix.
4. CWE-436 — Interpretation Conflict: https://cwe.mitre.org/data/definitions/436.html
5. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild status: No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-85184. The CVE is not listed in CISA KEV, and no named threat actor campaign or in-the-wild exploitation evidence is present in the supplied data. EPSS is 0.00316 (24.5th percentile). This assessment should be revisited if EPSS rises, if CISA KEV adds the CVE, or if a public PoC emerges.