CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html	Vendor Advisory
https://github.com/fastify/middie/security/advisories/GHSA-2v46-jxjm-7q3v	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:*

History

02 Jul 2026, 13:50

Type	Values Removed	Values Added
References	~~() https://cna.openjsf.org/security-advisories.html -~~	() https://cna.openjsf.org/security-advisories.html - Vendor Advisory
References	~~() https://github.com/fastify/middie/security/advisories/GHSA-2v46-jxjm-7q3v -~~	() https://github.com/fastify/middie/security/advisories/GHSA-2v46-jxjm-7q3v - Mitigation, Vendor Advisory
CPE		cpe:2.3:a:fastify:fastify\/middie::::::node.js::*
First Time		Fastify Fastify fastify\/middie

01 Jul 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-01 12:16

Updated : 2026-07-02 13:50

NVD link : CVE-2026-14198

Mitre link : CVE-2026-14198

CVE.ORG link : CVE-2026-14198

JSON object : View

Products Affected

fastify

fastify\/middie

CWE

CWE-436

Interpretation Conflict

{"id": "CVE-2026-14198", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14198", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T12:09:11.989341Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "@fastify/middie", "product": "@fastify/middie", "versions": [{"status": "affected", "version": "9.1.0", "lessThan": "9.3.3", "versionType": "semver"}, {"status": "unaffected", "version": "9.3.3", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/middie", "defaultStatus": "unaffected"}]}], "published": "2026-07-01T12:16:38.463", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/fastify/middie/security/advisories/GHSA-2v46-jxjm-7q3v", "tags": ["Mitigation", "Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request."}], "lastModified": "2026-07-02T13:50:22.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify\\/middie:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "959795F8-AC4A-486A-BA73-85D6AD107400", "versionEndExcluding": "9.3.3", "versionStartIncluding": "9.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}