@fastify/middie allows a middleware registered on a path prefix to be bypassed when an attacker uses URL‑encoded characters in that prefix, such as %61 for "a". The middleware engine incorrectly rejects the encoded path and skips execution, while the Fastify router decodes the URL and still delivers the intended route handler. This flaw permits attackers to reach endpoints that rely on middie middleware for authentication or authorization, effectively allowing unauthorized access without executing the protected logic. The weakness is classified as CWE‑177, fall‑through logic leading to an unintended code path.

The vulnerability affects all installations of the @fastify/middie plugin built before version 9.1.0, regardless of the Fastify core version. Users of the plugin should verify their package.json or lockfile to ensure the dependency is updated to v9.1.0 or later.

With a CVSS score of 8.4 and an EPSS below 1%, the vulnerability is rated high severity but expected exploitation is currently low. It is not listed in the CISA KEV catalog, indicating no confirmed exploits yet. An attacker can exploit the flaw remotely by crafting a URL that includes a percent‑encoded character in a protected path prefix. No local privileges or specific configuration are required beyond having an exposed Fastify server that uses middie for route protection. The attack is straightforward and requires no authentication to initiate the request.