CVE-2026-22031: Fastify @fastify/middie middleware path bypass via URL encoding

CVE-2026-22031 · Severity: high · CVSS 8.4 · Published 2026-01-19

@fastify/middie is a plugin for the Fastify web framework that allows developers to use middleware for tasks like security checks and access control. A flaw in how the plugin handles web addresses allows attackers to bypass these security checks by using URL-encoded characters (such as using '%61' instead of 'a'). This could allow unauthorized users to access sensitive administrative panels or protected data that should have been blocked by the middleware.

Technologies: Fastify Middie, @fastify/middie (npm). Vendors: Fastify, npm.

Quick answers

Is CVE-2026-22031 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22031 being exploited in the wild.
How severe is CVE-2026-22031?
High severity, with a CVSS score of 8.4, published 19 January 2026.
Which products and versions are affected?
Fastify Middie < 9.1.0; @fastify/middie (npm) SEMVER:introduced=0,fixed=9.1.0.
Is there a fix for CVE-2026-22031?
Yes. @fastify/middie (npm): upgrade to 9.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22031 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22031?
Check whether you run Fastify Middie or @fastify/middie (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @fastify/middie (npm): upgrade to 9.1.0 or later
    npm install @fastify/middie@9.1.0

Technical details

A vulnerability exists in @fastify/middie where middleware registered with a specific path prefix can be bypassed due to improper handling of URL encoding. The plugin's matching engine compares the raw, undecoded 'req.url' against a regex generated from the registered path. Because the regex expects a decoded string, an encoded request (e.g., '/%61dmin') fails to match the middleware but is subsequently decoded by Fastify's internal router, which then executes the protected route handler. This allows attackers to bypass security logic such as authentication or authorization checks implemented within the middleware. The issue is resolved in version 9.1.0 by decoding paths before matching.

Affected products

  • Fastify @fastify/middie < 9.1.0

Identifiers

  • CVE-2026-22031
  • GHSA-cxrg-g7r8-w69p

Timeline

  • 2025-12-29: other: Fix submitted via pull request
  • 2026-01-03: patched: Version 9.1.0 released
  • 2026-01-19: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.