What’s Vulnerable › Vulnerabilities

CVE-2026-22031: Fastify Middie Middleware Path Bypass

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-19 · updated 2026-06-17
• Weakness: CWE-177

Description

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

Affected products

• fastify middie: before 9.1.0 — fixed in 9.1.0

How to fix

Upgrade to a fixed version: fastify middie 9.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/fastify/middie/commit/d44cd56eb724490babf7b452fdbbdd37ea2effba
• https://github.com/fastify/middie/pull/245
• https://github.com/fastify/middie/releases/tag/v9.1.0
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p

Get alerted when CVE-2026-22031 or the next vulnerability affects your stack