https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:42:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266016 EUVD-2026-266016 https://cve.radiocsirt.org/vuln/euvd-2026-266016 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22031 <p>@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.</p> <p>@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22031 https://cve.radiocsirt.org/vuln/ghsa-cxrg-g7r8-w69p <p><strong>Affected:</strong> npm: @fastify/middie</p> <p>### Summary A security vulnerability exists in `@fastify/middie` where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints.</p> <p>### Details The vulnerability is caused by how `middie` matches requests against registered middleware paths.</p> <p>1. **Regex Generation**: When [fastify.use(&#39;/admin&#39;, ...)](cci:1://file:///Users/harshjaiswal/work/research/nest/packages/platform-fastify/adapters/fastify-adapter.ts:733:2-741:3) is called, `middie` uses `path-to-regexp` to generate a regular expression for the path `/admin`. 2. **Request Matching**: For every request, `middie` executes this regular expression against `req.url` (or `req.originalUrl`). 3. **The Flaw**: `req.url` in Fastify contains the **raw, undecoded** path string. * The generated regex expects a decoded path (e.g., `/admin`). * If a request is sent to `/%61dmin`, the regex comparison fails (`/^\/admin/` does not match `/%61dmin`). * `middie` assumes the middleware does not apply and calls `next()`. 4. **Route Execution**: The request proceeds to Fastify&#39;s internal router, which performs URL decoding. It correctly identifies `/%61dmin` as `/admin` and executes the correspon…</p> <p><strong>Affected:</strong> npm: @fastify/middie</p> <p>### Summary A security vulnerability exists in `@fastify/middie` where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of `/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints.</p> <p>### Details The vulnerability is caused by how `middie` matches requests against registered middleware paths.</p> <p>1. **Regex Generation**: When [fastify.use(&#39;/admin&#39;, ...)](cci:1://file:///Users/harshjaiswal/work/research/nest/packages/platform-fastify/adapters/fastify-adapter.ts:733:2-741:3) is called, `middie` uses `path-to-regexp` to generate a regular expression for the path `/admin`. 2. **Request Matching**: For every request, `middie` executes this regular expression against `req.url` (or `req.originalUrl`). 3. **The Flaw**: `req.url` in Fastify contains the **raw, undecoded** path string. * The generated regex expects a decoded path (e.g., `/admin`). * If a request is sent to `/%61dmin`, the regex comparison fails (`/^\/admin/` does not match `/%61dmin`). * `middie` assumes the middleware does not apply and calls `next()`. 4. **Route Execution**: The request proceeds to Fastify&#39;s internal router, which performs URL decoding. It correctly identifies `/%61dmin` as `/admin` and executes the correspon…</p> https://cve.radiocsirt.org/vuln/ghsa-cxrg-g7r8-w69p