Executive brief
@fastify/middie is a plugin for the Fastify web framework that allows developers to use middleware for tasks like security checks and access control. A flaw in how the plugin handles web addresses allows attackers to bypass these security checks by using URL-encoded characters (such as using '%61' instead of 'a'). This could allow unauthorized users to access sensitive administrative panels or protected data that should have been blocked by the middleware.
Technical details
A vulnerability exists in @fastify/middie where middleware registered with a specific path prefix can be bypassed due to improper handling of URL encoding. The plugin's matching engine compares the raw, undecoded 'req.url' against a regex generated from the registered path. Because the regex expects a decoded string, an encoded request (e.g., '/%61dmin') fails to match the middleware but is subsequently decoded by Fastify's internal router, which then executes the protected route handler. This allows attackers to bypass security logic such as authentication or authorization checks implemented within the middleware. The issue is resolved in version 9.1.0 by decoding paths before matching.
Affected products
- Fastify @fastify/middie < 9.1.0
Timeline
- 2025-12-29: other: Fix submitted via pull request
- 2026-01-03: patched: Version 9.1.0 released
- 2026-01-19: advisory: GitHub Security Advisory published