CVE-2026-22031

CVE-2026-22031 affects @fastify/middie versions prior to 9.1.0, allowing attackers to bypass middleware protection in Fastify applications. This high-severity vulnerability (CVSS 8.4) stems from the middleware engine failing to match URL-encoded path prefixes, while the Fastify router correctly decodes and processes the request, leading to unauthorized access to protected endpoints. The attack has a network vector and high impact on confidentiality and integrity, with low impact on availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.