Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the request target evaluation. An attacker can gain unauthorized access to protected routes by crafting requests with absolute-form targets that bypass...

CVE-2026-85184

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

EUVD-2026-70979

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184

@fastify/middie (a Fastify plugin for HTTP middleware) versions 9.1.0 through 9.3.3 are affected by a path-scoped middleware bypass. The root cause is a mismatch: middie evaluates the raw request target to decide whether to run path-scoped middleware, while the Fastify router resolves an absolute...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

PT-2026-85452

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.3 Description A mismatch occurs because the middleware evaluates the raw request target to determine if path-scoped middleware should run, whereas the Fastify router resolves an absolute-form request...