Read the docs
TI-2026-12029 Aliases CVE-2026-14198

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

Priority MEDIUM 48CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00517 44th percentileScored 2026-11-07
Fix Fixed @fastify/middie (@fastify/middie): 9.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/middie9.1.0 to before 9.3.39.3.3Patch availableCNA
  • @fastify/middie Vendorfastify Affected 9.1.0 to before 9.3.3 Fixed in 9.3.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:*9.1.0 to before 9.3.3Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:* Versions 9.1.0 to before 9.3.3 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/middie (@fastify/middie) Fixed in 9.3.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    @fastify/middie 9.3.3

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-12013 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded pathsPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14198

References

Advisory 2

  • TI-2026-05498 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVSS 3.1CRITICAL 9.1
  • TI-2026-17725 Fastify Middie Middleware Path Bypass CVSS 3.1HIGH 8.8
  • TI-2026-58517 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target CVSS 3.1CRITICAL 9.1
  • TI-2026-26176 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option CVSS 3.1CRITICAL 9.1
  • TI-2026-12013 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths CVSS 3.1HIGH 7.5
  • TI-2026-02474 @fastify/middie has an improper path normalization vulnerability CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences