PT-2026-3448 · Fastify · @Fastify/Middie

Rootxharsh · Published 2026-01-19 · Updated 2026-05-14 · CVE-2026-22031

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions @fastify/middie versions prior to 9.1.0

Description A security issue exists in @fastify/middie where middleware registered with a specific path prefix can be bypassed using URL-encoded characters. For example, using /%61dmin instead of /admin. The middleware engine fails to match the encoded path, skipping execution, but the Fastify router decodes the path and matches the route handler, potentially allowing access to protected endpoints. The issue occurs because the underlying Fastify router correctly decodes the path while the middleware engine does not. This allows attackers to bypass middleware constraints and access protected endpoints.

Recommendations Update @fastify/middie to version 9.1.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-177

Related Identifiers

CVE-2026-22031

GHSA-CXRG-G7R8-W69P

Affected Products

@Fastify/Middie

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22031.json · Exploit
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69p · Vendor Advisory
• https://github.com/fastify/middie/pull/245 · Patch
• https://github.com/fastify/middie/commit/d44cd56eb724490babf7b452fdbbdd37ea2effba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22031 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22031 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxrg-g7r8-w69p · Vendor Advisory
• https://github.com/fastify/middie · Note
• https://github.com/fastify/middie/releases/tag/v9.1.0 · Note
• https://twitter.com/TheHackerWire/status/2013295320088686910 · Twitter Post
• https://twitter.com/CVEnew/status/2013277739277504979 · Twitter Post
• https://t.me/cveNotify/163471 · Telegram Post
• https://t.me/cveNotify/155405 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2013291027545600089 · Twitter Post