Skip to content

fix: preserve query string when stripping path prefix#249

Merged
mcollina merged 1 commit into
fastify:mainfrom
panva:fix/preserve-query-string
Feb 28, 2026
Merged

fix: preserve query string when stripping path prefix#249
mcollina merged 1 commit into
fastify:mainfrom
panva:fix/preserve-query-string

Conversation

@panva

@panva panva commented Feb 28, 2026

Copy link
Copy Markdown
Contributor

When using app.use('/prefix', fn), the query string is stripped from req.url before it reaches the middleware.

This is a regression introduced in v9.2.0 by the GHSA-8p85-9qpw-fwgw fix. normalizedReqUrl is derived from normalizePathForMatching() which calls FindMyWay.sanitizeUrlPath() — this removes query strings. When req.url is rebuilt by stripping the matched prefix from normalizedReqUrl, the query string is already gone.

This fix preserves the query string suffix from the original req.url and re-appends it after prefix stripping.

Closes #248

Checklist

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@mcollina mcollina merged commit 499a26c into fastify:main Feb 28, 2026
14 checks passed
@panva panva deleted the fix/preserve-query-string branch February 28, 2026 11:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

app.use('/prefix', fn) strips query strings from req.url since v9.2.0

2 participants