CVE-2026-85184: falha crítica em @fastify/middie
@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.5%
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as authentication or authorization, is skipped. An unauthenticated network attacker can use this to bypass path-based access controls in a Fastify application that relies on middie for those controls. Users should upgrade to @fastify/middie 9.3.4 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
@fastify/middie · @fastify/middieCVEs relacionadas — @fastify/middie
No mesmo produto, das mais perigosas para as menos.
CVE-2026-14198CRITICAL@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesEPSS 0.5%CVE-2026-14181HIGH@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsEPSS 0.5%CVE-2026-6270CRITICAL@fastify/middie vulnerable to middleware authentication bypass in child plugin scopesEPSS 0.5%CVE-2026-2880HIGH@fastify/middie has an improper path normalization vulnerabilityEPSS 0.4%CVE-2026-112712CRITICAL@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatchEPSS 0.3%CVE-2026-33804HIGH@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionEPSS 0.3%