CVE-2026-22031: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22031 is a middleware path bypass vulnerability in @fastify/middie, the Fastify plugin that adds Express-style middleware support. Attackers with low-privilege credentials can bypass middleware security controls (authentication, authorization, rate limiting, IP filtering) by sending requests with URL-encoded path characters (e.g., /%61dmin instead of /admin). All versions of @fastify/middie up to and including 9.0.3 are affected; version 9.1.0 contains the fix. The vulnerability was published on January 19, 2026, with a CVSS v3.1 base score of 8.8 (High) per NVD and 8.4 (High) per the GitHub Security Advisory (Github Advisory, Feedly).

The root cause is classified as CWE-177 (Improper Handling of URL Encoding / Hex Encoding). When fastify.use('/admin', middleware) is called, middie uses path-to-regexp to generate a regex for the path and then matches it against req.url, which contains the raw, undecoded URL string. If a request arrives as /%61dmin, the regex /^\/admin/ fails to match the percent-encoded form, so middie calls next() and skips the middleware entirely. However, Fastify's internal router (find-my-way) decodes the URL before routing and correctly resolves /%61dmin to /admin, executing the route handler without any middleware constraints. The fix (PR #245, commit d44cd56) applies FindMyWay.sanitizeUrlPath() to decode the URL before regex matching in lib/engine.js. A public proof-of-concept is included in the security advisory (Github Advisory, Fix PR, Fix Commit).

Successful exploitation allows an authenticated attacker to completely bypass middleware-enforced security controls — including authentication checks, authorization gates, rate limiting, and IP filtering — applied to specific route prefixes. This can result in unauthorized access to sensitive or administrative endpoints, exposure of confidential data, and unauthorized modification of application state. The scope is marked as "Changed" in the GitHub advisory's CVSS scoring, indicating that the impact can extend beyond the vulnerable component itself to other resources protected by the bypassed middleware (Github Advisory).

A public proof-of-concept exploit is included in the official GitHub Security Advisory and is trivially reproducible with a single curl command. As of the advisory publication date, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.056% (per Feedly) to 0.144% (per GitHub Advisory), placing it in the 34th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory, Feedly).

1. Reconnaissance: Identify Fastify-based web applications that use @fastify/middie (versions ≤ 9.0.3) and rely on middleware registered with path prefixes for security enforcement (e.g., /admin, /api/internal). This can be done by inspecting HTTP response headers (e.g., X-Powered-By: Fastify) or reviewing publicly available source code.
2. Identify protected endpoints: Confirm that a target path (e.g., /admin) is protected by middleware by sending a normal request and observing a 403 or redirect response: curl http://target/admin → Forbidden: Access to /admin is blocked.
3. Craft URL-encoded bypass request: Replace one or more characters in the path with their percent-encoded equivalents (e.g., encode a as %61): /%61dmin resolves to /admin after decoding.
4. Send bypass request: Issue the crafted request to the server: curl http://target/%61dmin. The middie middleware regex fails to match /%61dmin and skips execution, while Fastify's router decodes the path and serves the protected route handler.
5. Access protected resource: The server responds with the protected content (e.g., {"message": "Admin panel"}), confirming the middleware bypass and granting access to the protected endpoint without any security constraints (Github Advisory).

• Network: HTTP requests to protected path prefixes using percent-encoded characters (e.g., GET /%61dmin, GET /%61pi/internal) that return 200 responses instead of expected 403/401 responses; unusual access patterns to administrative endpoints from unexpected source IPs.
• Logs: Web server or application access logs showing requests with URL-encoded path segments (e.g., %61, %2F, %64) targeting known protected routes that result in successful (2xx) responses; absence of expected middleware log entries (e.g., auth checks, rate limit logs) for requests that successfully reached route handlers.
• Application Behavior: Route handlers for protected paths being invoked without corresponding middleware execution logs; missing audit trail entries for access to sensitive endpoints that should have been intercepted by middleware (Github Advisory).

The primary remediation is to upgrade @fastify/middie to version 9.1.0 or later, which decodes URLs using FindMyWay.sanitizeUrlPath() before middleware path matching (v9.1.0 Release). As a temporary workaround until patching is complete, implement authentication and authorization checks directly within route handlers rather than relying solely on middleware-based path prefix protection. Additionally, review application access logs for suspicious URL-encoded requests targeting protected endpoints. Note that a parallel fix was also applied to @fastify/fastify-express (PR #174) for the same class of vulnerability (Fix PR).

The vulnerability was reported by security researcher rootxharsh and remediated by NestJS contributor kamilmysliwiec along with Fastify core maintainers Eomm and mcollina. The fix was initially submitted as a public pull request, prompting maintainer mcollina to note that vulnerabilities should be reported privately in the future; kamilmysliwiec clarified the issue had already been submitted through private channels. The advisory was picked up by CISA's weekly vulnerability bulletin (SB26-026) and covered by security aggregators including Vulners, CVEFeed, and The Hacker Wire (Github Advisory, Fix PR).