CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-14198

The CVE-2026-14198 entry concerns @fastify/middie versions 9.1.0–9.3.2, where encoded slashes (%2F) in path parameter values are decoded by middie but not by Fastify’s router during route lookup. This mismatch lets a crafted URL bypass middleware-based security (authentication/authorization/rate ...

PT-2026-54639

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.2 Description An authorization bypass occurs because the software decodes the encoded slash %2F within path parameter values before matching middleware paths, whereas the underlying router preserves...

CVE-2026-14181: Uncaught Exception

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

CVE-2026-14198: Interpretation Conflict

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-33804

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicat...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.95 Source cves: CVE-2026-6270 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098213...

GHSA-72C6-FX6Q-FR5W @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Impact @fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fail...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.95 Source cves: CVE-2026-6270 Source advisory: OSV:GHSA-72C6-FX6Q-FR5W...

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Impact @fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fail...

EUVD-2026-23241

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes...

EUVD-2026-23235

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-33804 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.95 Source cves: CVE-2026-33804 Source advisory: OSV:GHSA-V9WW-2J6R-98Q6...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict in the resolveNormalizationOptions function's deprecated ignoreDuplicateSlashes configuration option. An attacker can bypass middleware by crafting URLs with...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-33804 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.95 Source cves: CVE-2026-33804 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098212...

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Impact @fastify/middie v9.3.1 and earlier does not read the deprecated but still functional top-level ignoreDuplicateSlashes option, only reading from routerOptions. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via...

CVE-2026-33804

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicat...

CVE-2026-6270

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...