Read the docs
TI-2026-12013 Aliases CVE-2026-14181

@fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

Priority LOW 39CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications using the Fastify plugin path are not affected because Fastifys error handler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the exception.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Fix Fixed @fastify/middie (@fastify/middie): 9.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/middie9.1.0 to before 9.3.39.3.3Patch availableCNA
  • @fastify/middie Vendorfastify Affected 9.1.0 to before 9.3.3 Fixed in 9.3.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:*9.1.0 to before 9.3.3Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:* Versions 9.1.0 to before 9.3.3 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/middie (@fastify/middie) Fixed in 9.3.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    @fastify/middie 9.3.3

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12029 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter valuesPriority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14181

References

Advisory 2

  • TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
  • TI-2026-17725 Fastify Middie Middleware Path Bypass CVSS 3.1HIGH 8.8
  • TI-2026-58517 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target CVSS 3.1CRITICAL 9.1
  • TI-2026-12029 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values CVSS 3.1CRITICAL 9.1
  • TI-2026-26176 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option CVSS 3.1CRITICAL 9.1
  • TI-2026-02474 @fastify/middie has an improper path normalization vulnerability CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences