The vulnerability occurs because @fastify/middie decodes encoded slashes (%2F) in path parameter values before matching middleware routes, while Fastify’s router keeps the encoding during route resolution. This represents a CWE‑436 weakness, a failure to perform privilege and access control. The mismatch causes middleware that relies on the path parameter to fail to match, even though the target route handler still receives the request. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can bypass those controls by sending a single URL that contains an encoded slash in a parameter position. The exploit is HTTP‑method agnostic and does not require prior authentication.

The affected product is @fastify/middie, with versions 9.1.0 through 9.3.2.

CVSS score of 9.1 indicates critical severity. EPSS score is less than 1%, implying a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires no special conditions and can be carried out by any user who can send an HTTP request, using a single crafted URL that includes an encoded slash in a path parameter.