Vulnerability · Published Jan 19, 2026 · Assigned by GitHub_M

CVE-2026-22031Fastify Middie Middleware Path Bypass

High 8.4

In plain English

A high-severity security flaw in middie from fastify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@fastify/middie	9.1.0	GHSA-cxrg-g7r8-w69p

Affected products (as reported)

Vendor	Product	Versions
fastify	middie	< 9.1.0

Weakness: CWE-177 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p x_refsource_CONFIRM
https://github.com/fastify/middie/pull/245 x_refsource_MISC
https://github.com/fastify/middie/commit/d44cd56eb724490babf7b452fdbbdd37ea2effba x_refsource_MISC
https://github.com/fastify/middie/releases/tag/v9.1.0 x_refsource_MISC