The vulnerability arises because @fastify/middie decodes encoded slashes (%2F) inside path parameters before matching middleware routes, while Fastify’s router keeps them encoded during route resolution. This mismatch, a CWE‑436 Business Logic Error, causes the middleware to fail to match a URL that the target route handler actually receives, allowing an attacker to load a protected handler by sending a single crafted URL containing an encoded slash in the parameter position. The bypass is HTTP‑method agnostic and does not require authentication or any special environment, effectively providing unauthorized access when middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths.

The affected product is @fastify/middie, versions 9.1.0 through 9.3.2, which decode encoded slashes before matching middleware paths.

CVSS score 9.1 indicates critical severity. EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in KEV. The attack requires no special conditions and can be performed by any user who can send an HTTP request, using a single URL that includes an encoded slash in a path parameter. Because it bypasses middleware protections, the attacker can access routes protected only by these middleware layers.