CVE-2026-22031
Description
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.
How to fix
- @fastify/middie9.1.0 or later
- fastify fastify\/middie9.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @fastify/middienpm | v < 9.1.0 | 9.1.0 |
| fastify fastify\/middie | v < 9.1.0 | 9.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.