Skip to content

Conversation

@Eomm
Copy link
Member

@Eomm Eomm commented Jan 3, 2026

A PR to the fix

Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mcollina mcollina merged commit 941f1d1 into fix/decode-paths-before-matching Jan 5, 2026
25 of 28 checks passed
Eomm added a commit that referenced this pull request Jan 5, 2026
* fix: decode paths before matching

URL-encoded paths could bypass middleware (e.g., /%61dmin would bypass
middleware registered on /admin). This uses FindMyWay.sanitizeUrlPath()
to decode URLs before Express matches middleware, consistent with the
fix in fastify/middie#245.

* fix: handle express handlers (#175)

---------

Co-authored-by: Manuel Spigolon <manuel.spigolon@nearform.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants