fix: decode paths before matching

[kamilmysliwiec]

Fix on the NestJS side nestjs/nest#16135

instance.use('/admin', function (req, _res, next) {
  // check headers here to ensure caller is allowed to access this endpoint
  // <auth logic>
  next()
})

if someone calls your-api:3000/%61dmin, no middleware will be triggered, even though the /admin endpoint (handler) would be executed (as find-my-way decode URLs before matching routes)

credit for reporting this issue goes to Hacktron AI

Checklist

• run npm run test && npm run benchmark --if-present
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[gurgunday]

lgtm

can you run npm run lint:fix?

[mcollina]

@kamilmysliwiec in the future, please report vulnerability privately.

[kamilmysliwiec]

@mcollina i was informed that the vulnerability has already been submitted privately - i wasn't the one who found it

[Eomm]

@mcollina i was informed that the vulnerability has already been submitted privately - i wasn't the one who found it

https://github.com/fastify/fastify/blob/main/SECURITY.md#publication

Within 90 days after the triage date, the vulnerability must be made public.

[mcollina]

lgtm