Listen to this Post
The vulnerability in @fastify/express stems from a mismatch in path decoding between middleware registration and route handling. When Express-style middleware is registered with a path prefix, such as ‘/admin’, it is intended to intercept all requests starting with that prefix. However, the middleware matching logic does not decode URL-encoded characters before comparison. For example, a request to ‘/%61dmin’ (where ‘%61’ is the URL encoding for ‘a’) is not recognized by the middleware as matching the ‘/admin’ prefix, so the middleware skips execution.
Conversely, the underlying Fastify router correctly decodes the URL-encoded path before matching routes. Thus, the same request to ‘/%61dmin’ is decoded to ‘/admin’ and successfully matched to the corresponding route handler. This discrepancy allows attackers to bypass middleware protections—like authentication or authorization checks—by simply encoding characters in the path, granting unauthorized access to protected endpoints without triggering the middleware.
Platform: @fastify/express
Version: All affected
Vulnerability: URL encoding bypass
Severity: Critical
Date: 2026-01-21
Prediction: Unknown patch date
What Undercode Say:
Analytics
curl http://206.189.140.29:3000/%61dmin
const fastify = require('fastify')({ logger: true });
async function start() {
await fastify.register(require('@fastify/express'));
fastify.use('/admin', (req, res, next) => {
res.statusCode = 403;
res.end('Forbidden: Access to /admin is blocked');
});
fastify.get('/admin', async (request, reply) => {
return { message: 'Admin panel' };
});
await fastify.listen({ port: 3000 });
}
start();
How Exploit:
Use URL-encoded paths
Protection from this CVE:
Normalize paths pre-matching
Impact:
Unauthorized endpoint access
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
