AIKIDO-2026-183302

TL;DR

@fastify/middie decodes the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so middleware fails to match a URL that the route handler still matches. When middleware enforces authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler with a crafted URL such as /user/a%2Fb/comments without authentication. The fix decodes nested percent-encoded bytes so the middleware and router agree on the path.