CVE-2026-22031

HIGH EPSS 36.4%
Published Jan 19, 20265mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
High
Find Similar
Published Jan 19, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
36.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-177

Affected Products 1

VendorProductVersionRange
fastifyfastify\/middie* <9.1.0

References 4

  • github.com https://github.com/fastify/middie/commit/d44cd56eb724490babf7b452fdbbdd37ea2effba
    Patch
  • github.com https://github.com/fastify/middie/pull/245
    Issue TrackingPatch
  • github.com https://github.com/fastify/middie/releases/tag/v9.1.0
    ProductRelease Notes
  • github.com https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/fastify/middie/commit/d44cd56eb724490babf7b452fdbbdd37ea2effba
    Patch
  • github.com https://github.com/fastify/middie/pull/245
    Issue TrackingPatch