CVE-2026-22031

The record

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-cxrg-g7r8-w69p Fastify Middie Middleware Path Bypass Same vulnerability
• GHSA-72c6-fx6q-fr5w @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes Also affects @fastify/middie
• GHSA-v9ww-2j6r-98q6 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes… Also affects @fastify/middie
• CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the… Also affects @fastify/middie
• CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly… Also affects @fastify/middie
• GHSA-8p85-9qpw-fwgw @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware Also affects @fastify/middie
• CVE-2026-2880 A vulnerability in @fastify/middie versions < 9.2.0 can result in… Also affects @fastify/middie
• CVE-2026-96748 PyMongo's connection string parsing decodes percent-encoded characters in the host… CWE-177