CVE-2026-22031 Fastify Middie Middleware Path Bypass

What is CVE-2026-22031?

CVE-2026-22031 is a high-severity vulnerability in fastify middie, published on 19 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

Weakness: CWE-177

Which versions are affected by CVE-2026-22031?

2 open source packages ship an affected version, including @fastify/middie. It affects 1 product.

Products include Fastify Fastify\/Middie.

How do I fix CVE-2026-22031?

Upgrade @fastify/middie to 9.1.0 or later.

Is CVE-2026-22031 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22031 exists.

Other vulnerabilities in fastify middie

• CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target Critical 9.1
• CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values Critical 9.1
• CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes Critical 9.1
• CVE-2026-2880 @fastify/middie has an improper path normalization vulnerability High 8.2
• CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cxrg-g7r8-w69p.