CVE-2026-22031
Fastify\/Middie ≤ 9.1.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:LSummary
CVE-2026-22031 is a high-severity Hex Encoding (CWE-177) vulnerability in Fastify Fastify\/Middie. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22031 is a security vulnerability in the @fastify/middie plugin, which provides enhanced middleware support for the Fastify web framework. Affecting versions prior to 9.1.0, the issue stems from the middleware engine's failure to properly handle URL-encoded characters in path prefixes. For example, a path like `/admin` protected by middleware can be bypassed by sending an encoded variant such as `/%61dmin`, where `%61` decodes to `a`. While the middleware skips execution due to a path mismatch, Fastify's underlying router decodes the path correctly and proceeds to match and execute the route handler.
An attacker with low privileges (PR:L) can exploit this over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H) due to the need for precise encoding. Successful exploitation allows bypassing middleware constraints, such as authentication or authorization checks, on protected endpoints. This grants high confidentiality and integrity impacts (C:H/I:H) with low availability impact (A:L), and the scope changes (S:C) to affect the Fastify router component.
Mitigation is available via upgrade to version 9.1.0 of @fastify/middie, which addresses the path matching issue. Relevant advisories and fixes are detailed in the GitHub security advisory (GHSA-cxrg-g7r8-w69p), pull request #245, commit d44cd56eb724490babf7b452fdbbdd37ea2effba, and the v9.1.0 release notes. The vulnerability is classified under CWE-177 (Incorrect Behavior Order: Early Validation) with a CVSS v3.1 base score of 8.4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3321
Vulnerability Data
@fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in @fastify/middie prior to version 9.1.0 where middleware registered with a specific path prefix can be bypassed using URL-encoded characters (e.g., `/%61dmin` instead of…
more
`/admin`). While the middleware engine fails to match the encoded path and skips execution, the underlying Fastify router correctly decodes the path and matches the route handler, allowing attackers to access protected endpoints without the middleware constraints. Version 9.1.0 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.2
Mitigating Controls (NIST 800-53 r5) AI
Proper input validation requires decoding and checking URL-encoded data before use, directly stopping the weakness from being exploitable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct URL-encoding/decoding and input validation during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches URL-decoding flaws before release, but does not itself define coding rules.
Secure SDLC processes include validation steps that reduce CWE-177, yet the control is broader than this single weakness.
Application security requirements explicitly call for input validation and canonicalization, directly preventing improper URL decoding.
Secure coding standards mandate proper handling and decoding of encoded inputs, eliminating CWE-177.