CVE-2026-22031

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

• CWE-177

• https://github.com/fastify/middie/commit/d44cd56eb724490babf7b452fdbbdd37ea2effbaPatch
• https://github.com/fastify/middie/pull/245Issue Tracking, Patch
• https://github.com/fastify/middie/releases/tag/v9.1.0Product, Release Notes
• https://github.com/fastify/middie/security/advisories/GHSA-cxrg-g7r8-w69pExploit, Vendor Advisory

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22026CryptoLib provides a software-only solution using the CCSDS …7.5
• CVE-2026-22027CryptoLib provides a software-only solution using the CCSDS …6
• CVE-2026-22028Preact, a lightweight web development framework, JSON serial…6.1
• CVE-2026-22029React Router is a router for React. In @remix-run/router ver…6.1
• CVE-2026-2203A flaw has been found in Tenda AC8 16.03.33.05. Affected by …8.8
• CVE-2026-22030React Router is a router for React. In @remix-run/server-run…6.5
• CVE-2026-22032Directus is a real-time API and App dashboard for managing S…6.1
• CVE-2026-22033Label Studio is a multi-type data labeling and annotation to…5.4
• CVE-2026-22034Snuffleupagus is a module that raises the cost of attacks ag…9.8
• CVE-2026-22035Greenshot is an open source Windows screenshot utility. Vers…7.3
• CVE-2026-22036Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 an…7.5
• CVE-2026-22037The @fastify/express plugin adds full Express compatibility …8.4