Fastify Middie Middleware Bypass via Absolute-Form Requests

CVE-2026-85184 is a critical authentication and authorization bypass vulnerability in @fastify/middie versions 9.1.0 through 9.3.3. The flaw exploits a divergence in how middleware and routing layers parse HTTP request targets: middleware evaluates the raw absolute-form request target (e.g., http://example.com/path), while the Fastify router normalizes it to a relative path before dispatching. Attackers can craft requests using absolute-form targets to reach protected route handlers while circumventing path-scoped security controls like authentication and authorization middleware. This affects any application using vulnerable versions of @fastify/middie without proper upgrade, potentially exposing sensitive endpoints to unauthenticated access.

While this CVE currently maps to zero explicit MITRE ATT&CK techniques, Casky's AI-driven security skills would identify this as an instance of improper input validation and inconsistent security enforcement—classic precursors to T1550 (Use Alternate Authentication Material) and T1548 (Abuse Elevation Control Mechanism) patterns. Practitioners leveraging Casky would observe findings related to authentication bypass detection, middleware configuration anomalies, and HTTP request parsing inconsistencies in their security posture. Extended reasoning capabilities would surface the root cause: the semantic gap between how different application layers interpret the same request, enabling attackers to evade intended security checks. Security teams would be alerted to review middleware configurations, implement input normalization validation, and audit request handling logic across routing and middleware layers.