Review reviewHigh

CVE-2026-14181

@fastify/middie @fastify/middie, fastify/middie

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications usin...

CVSS: 7.5
EPSS: 0.29%
CISA KEV: Not listed
Published: 2026.07.01

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.29%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: @fastify/middie @fastify/middie, fastify/middie
Affected versions: 9.1.0, >= 9.1.0 < 9.3.3
Fixed versions: 9.3.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that @fastify/middie @fastify/middie, fastify/middie and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-248