EUVD-2026-40946Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers reach protected parameterized route handlers by placing an encoded slash (%2F) in a path parameter. The middleware layer decodes %2F before matching while Fastify's router preserves the encoding, so the two disagree on the canonical path and any middie-based auth, authz, rate-limiting, or auditing middleware silently fails to run while the route handler still fires. No public exploit identified at time of analysis; the flaw is method-agnostic and requires no special preconditions, and the vendor rates it CVSS 9.1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Fastify Middie gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (openjs) · only source for this CVE.
CVSS VectorVendor: openjs
Lifecycle Timeline
1DescriptionCVE.org
@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.
Executive ViewAI
Fastify middie versions 9.1.0-9.3.2 contain an authentication bypass that allows unauthenticated attackers to access protected resources and APIs by exploiting path encoding, completely bypassing your authorization middleware. Organizations running affected versions have lost a critical layer of access control, exposing all protected endpoints to unauthorized access. Immediate remediation is required.
24 hours: Inventory all deployments running @fastify/middie 9.1.0-9.3.2; verify impact scope across production and staging environments; subscribe to CISA alerts and fastify security advisories. 7 days: Deploy compensating controls (WAF rules rejecting encoded path separators in URLs; implement request normalization before middleware evaluation; enable detailed audit logging). 30 days: Evaluate downgrade path to @fastify/middie 9.0.x if feasible; maintain compensating controls and continuous monitoring until patched version 9.3.3+ is released; test patch thoroughly before deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Configure WAF to block or decode %2F (encoded slash) and %5C (encoded backslash) in request paths before routing; (2) Normalize all incoming URLs at ingress layer before middleware processing; (3) Downgrade to @fastify/middie 9.0.x or earlier if operationally feasible; (4) Implement continuous logging and real-time alerting for requests containing encoded path separators; (5) Network-layer access restrictions on affected APIs if possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Fastify Middie
View allPath-based access-control bypass in @fastify/middie (Fastify's Express-style middleware engine) versions 9.1.0 through 9
Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a sing
Authentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because
Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protect
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach
Exploit-DB