CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.

Scoring

Severity

CRITICAL

CVSS base score

9.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS probability

0.52%

CWE

CWE-436

Published

2026-07-01

Last modified

2026-07-01

Affected products

• @fastify/middie @fastify/middie
• @fastify/middie @fastify/middie

Weakness type

• CWE-436

Related vulnerabilities

• CVE-2026-87627 — Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a...
• CVE-2026-82537 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch
• CVE-2026-81378 — Visual Studio Code Security Feature Bypass Vulnerability
• CVE-2026-85184 — @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
• CVE-2026-84394 — fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
• CVE-2026-63435 — Mail: Email address spoofing via malformed RFC 2047 encoded-words
• CVE-2026-75931 — fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• CVE-2026-57580 — authentik: Account Takeover via SAML NameID Comment Truncation

Markdown version · Browse all CVEs