https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:49:01.505234+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-266016 EUVD-2026-266016 2026-10-07T03:49:01.549986+00:00 EUVD-2026-266016 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22031 fkie_cve-2026-22031 2026-10-07T03:49:01.550021+00:00

@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-cxrg-g7r8-w69p GHSA-cxrg-g7r8-w69p — Fastify Middie Middleware Path Bypass 2026-10-07T03:49:01.550055+00:00

Affected: npm: @fastify/middie

### Summary A security vulnerability exists in `@fastify/middie` where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints.

### Details The vulnerability is caused by how `middie` matches requests against registered middleware paths.

1. **Regex Generation**: When [fastify.use('/admin', ...)](cci:1://file:///Users/harshjaiswal/work/research/nest/packages/platform-fastify/adapters/fastify-adapter.ts:733:2-741:3) is called, `middie` uses `path-to-regexp` to generate a regular expression for the path `/admin`. 2. **Request Matching**: For every request, `middie` executes this regular expression against `req.url` (or `req.originalUrl`). 3. **The Flaw**: `req.url` in Fastify contains the **raw, undecoded** path string. * The generated regex expects a decoded path (e.g., `/admin`). * If a request is sent to `/%61dmin`, the regex comparison fails (`/^\/admin/` does not match `/%61dmin`). * `middie` assumes the middleware does not apply and calls `next()`. 4. **Route Execution**: The request proceeds to Fastify's internal router, which performs URL decoding. It correctly identifies `/%61dmin` as `/admin` and executes the correspon…