CVE-2026-22037: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22037 is a middleware bypass vulnerability in the @fastify/express npm plugin that allows attackers to circumvent path-based middleware security controls using URL-encoded characters. Specifically, requests using hex-encoded paths (e.g., /%61dmin instead of /admin) are not matched by the middleware engine but are correctly decoded and routed by the underlying Fastify router, granting unauthorized access to protected endpoints. The vulnerability affects all versions of @fastify/express up to and including 4.0.2, and was disclosed on January 19, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Fastify Security Advisory).

The root cause is improper handling of URL encoding (CWE-177) combined with authentication bypass via an alternate path (CWE-288). When @fastify/express processes incoming requests, its middleware matching logic compares the raw, un-decoded request URL against registered middleware path prefixes. Because the middleware engine does not decode percent-encoded characters before matching, a request to /%61dmin fails to match a middleware registered on /admin and is skipped entirely. However, the underlying Fastify router applies URL decoding before routing, correctly resolving /%61dmin to /admin and dispatching the request to the protected route handler — without any middleware constraints being applied. The fix, introduced in commit dc02a3f, applies FindMyWay.sanitizeUrlPath() to decode the URL before Express middleware matching, ensuring consistency between the middleware engine and the router (Fastify Security Advisory, Patch Commit). A public proof-of-concept is included in the advisory itself.

Successful exploitation allows a low-privileged attacker to bypass middleware-enforced access controls and reach protected endpoints without authorization, resulting in high confidentiality and integrity impacts. Sensitive data exposed behind middleware guards (e.g., admin panels, internal APIs) can be read or modified, and protected operations can be performed without the intended security constraints. Availability impact is rated low, as the vulnerability primarily enables unauthorized access rather than service disruption. IBM API Connect is among the known affected downstream products (GitHub Advisory, IBM Advisory).

A public proof-of-concept is included in the official GitHub Security Advisory, demonstrating exploitation with a simple curl command using a hex-encoded path. Exploitation requires low privileges (an authenticated user account) and high attack complexity per the CVSS scoring. There is no evidence of in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time. The EPSS score is approximately 0.034% (10th percentile), indicating a low near-term exploitation probability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications using @fastify/express versions ≤ 4.0.2 that rely on path-prefix middleware for access control (e.g., blocking /admin, /api/internal).
2. Identify protected paths: Probe the application to discover routes protected by middleware (e.g., /admin returns 403 Forbidden when accessed directly).
3. Craft URL-encoded request: Replace one or more characters in the protected path with their percent-encoded hex equivalents (e.g., encode a as %61, turning /admin into /%61dmin).
4. Send encoded request: Issue an HTTP request using the encoded path: curl http://target:3000/%61dmin. The middleware engine fails to match /%61dmin against /admin and skips execution.
5. Access protected resource: The Fastify router decodes /%61dmin to /admin and routes the request to the handler, returning the protected resource without middleware constraints applied (Fastify Security Advisory).

• Network: HTTP requests to protected path prefixes using percent-encoded characters (e.g., /%61dmin, /%61pi/internal) in access logs; requests that receive 200 OK responses for paths that should return 403 Forbidden.
• Logs: Web server or application access logs showing requests with %XX-encoded path segments targeting sensitive routes (e.g., /admin, /dashboard, /api) that bypass expected middleware responses; absence of middleware-generated 403 log entries for requests that successfully reached protected handlers.
• Application Behavior: Unexpected successful responses (HTTP 200) for paths that should be blocked by middleware, particularly where the decoded path matches a protected prefix but the raw URL contains hex-encoded characters (Fastify Security Advisory).

Upgrade @fastify/express to version 4.0.3 or later, which decodes URL paths using FindMyWay.sanitizeUrlPath() before middleware matching, eliminating the bypass (Fastify Security Advisory, Patch Commit). As a defense-in-depth measure while patching, implement additional input validation and URL normalization at the application or reverse proxy layer to reject or normalize percent-encoded paths before they reach the application. Review access logs for suspicious requests containing %XX hex-encoded patterns targeting sensitive paths to identify potential exploitation attempts (Feedly). IBM API Connect users should refer to IBM's advisories for product-specific patch guidance (IBM Advisory).

The vulnerability was reported by security researcher rootxharsh, with remediation verified by Eomm and developed by mcollina from the Fastify core team (Fastify Security Advisory). The advisory notes its similarity to CVE-2026-22031, which affects a different but related npm module (middie), suggesting a broader pattern of URL-encoding bypass issues in the Fastify middleware ecosystem. The vulnerability was picked up by CISA's weekly vulnerability bulletin and covered by security aggregators shortly after disclosure (CISA Bulletin).