Middleware Bypass Vulnerability in @fastify/middie Plugin

CVE-2026-22031

What is CVE-2026-22031?

A vulnerability exists in the @fastify/middie plugin prior to version 9.1.0, where specific path prefixes can be exploited using URL-encoded characters to bypass registered middleware. This occurs because the middleware engine fails to properly match the encoded paths, while the Fastify router decodes them correctly, granting attackers access to protected endpoints without the intended middleware restrictions. The issue is resolved in version 9.1.0, emphasizing the importance of regular updates and security reviews.

References