CVE-2026-22031: @fastify/middie Authentication Bypass via URL Encoding
Summary
CVE-2026-22031: Fastify Middie Middleware Path Bypass. Affects @fastify/middie versions < 9.1.0. Fixed in 9.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fastify/middie package is a middleware engine for Fastify, designed to support Express-style middleware in Fastify applications. It allows developers to register middleware functions that can process requests before they reach route handlers. This package is widely used for implementing security controls such as authentication, authorization, and rate limiting. However, it is vulnerable to a path bypass issue that can allow unauthorized access to protected routes.
Vulnerability Detail
A security vulnerability exists in @fastify/middie where middleware registered with specific path prefixes can be bypassed using URL-encoded characters. The flaw arises from the way middie matches requests against registered middleware paths. When a request is made with an encoded path (e.g., /%61dmin instead of /admin), the middleware fails to execute because it uses a regular expression that does not account for URL encoding. This allows attackers to access protected endpoints without the middleware constraints, leading to potential unauthorized access to sensitive areas of an application.
How To Fix
Minimum fixed version
9.1.0
This is the first release that contains the fix.
npm install @fastify/middie@9.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your middleware to validate the request path before processing it. For example, you could manually decode the URL and compare it against the expected path, ensuring that encoded paths do not bypass your security measures.
Conclusion
The @fastify/middie package has a significant vulnerability that allows for authentication and authorization bypass through URL encoding. It is crucial for developers using this package to update to the patched version to protect their applications from potential unauthorized access. Implementing additional checks as a temporary workaround can help mitigate the risk until the update is applied.
See every vulnerability recorded for @fastify/middie →
FAQ
CVE-2026-22031 is a vulnerability in the @fastify/middie package that allows attackers to bypass middleware security checks using URL-encoded paths.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The vulnerability can lead to unauthorized access to protected routes, allowing attackers to bypass critical security middleware such as authentication and authorization.
You can update the package by running the command: npm install @fastify/middie@^9.1.0 in your project directory.
The CVSS score for this vulnerability is 8.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @fastify/middie.
