Fastify Middie
CVE-2026-22031
HIGH
GHSA-cxrg-g7r8-w69p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with percent-encoded path segments
-
DeliverySend request to @fastify/middie application
-
ExploitMiddleware path matching fails on encoded URL
-
ExecutionFastify router decodes and matches route handler
-
ImpactAccess protected endpoint bypassing middleware constraints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization URL encoding handling
|
| Exploitation Conditions | Authenticated user account required (PR:L). @fastify/middie versions prior to 9.1.0 with middleware registered using path prefix protection. Fastify application must have both middleware protection and route handlers behind the same path prefix. |
| Impact | CVSS 8.4 (HIGH). Attack vector: Network. Complexity: High. Privileges required: Low. User interaction: None. Exploitation requires authentication. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protected endpoints by using URL-encoded characters in requests, as the middleware engine fails to decode paths while the underlying router does. An attacker with valid credentials can exploit this inconsistency to circumvent middleware security controls and access restricted functionality. This vulnerability requires low privileges and network access, with no patch currently available.
Earlier versions of this analysis (1)
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admin). [CVSS 8.4 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects fastify/middie. @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admin). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access prot
Know when Fastify Middie gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., /%61dmin instead of /admin). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.
Executive ViewAI
CVE-2026-22031 presents notable security risk rated CVSS 8.4. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
More in Fastify Middie
View allPath-based access-control bypass in @fastify/middie (Fastify's Express-style middleware engine) versions 9.1.0 through 9
Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a sing
Authentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers rea
Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach
Exploit-DB