Authorization bypass via raw encoded-path matching

Authorization bypass in Fastify @fastify/middie before 9.1.0 allows remote authenticated users to reach protected routes via encoded URLs. The Holder path-matching logic applies a path-to-regexp expression to the raw req.url, so an encoded prefix fails to match and the middleware calls next(), while Fastify later decodes the same path for routing. Exploitation requires an application that attaches security middleware to a path prefix; a crafted request then reaches handlers without those controls.