CVE-2026-85184

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

CVE-2026-85184

@fastify/middie (a Fastify plugin for HTTP middleware) versions 9.1.0 through 9.3.3 are affected by a path-scoped middleware bypass. The root cause is a mismatch: middie evaluates the raw request target to decide whether to run path-scoped middleware, while the Fastify router resolves an absolute...

EUVD-2026-70979

@fastify/middie versions = 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request...

Uncaught Exception

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Uncaught Exception in the URL normalization process when handling malformed percent-encoded sequences in incoming request paths. An attacker can cause the Node.js process to terminate...

@arenahito/droid-webscr (>=0.2.1, <=0.6.0), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14181 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14181 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753355...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the path parameter handling process. An attacker can gain unauthorized access to protected route handlers by sending a crafted URL containing an encoded slas...

@arenahito/droid-webscr (>=0.2.1, <=0.6.0), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14198 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14198 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753414...

CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-14181

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

CVE-2026-14181

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

EUVD-2026-40947

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder t...

CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-14198

The CVE-2026-14198 entry concerns @fastify/middie versions 9.1.0–9.3.2, where encoded slashes (%2F) in path parameter values are decoded by middie but not by Fastify’s router during route lookup. This mismatch lets a crafted URL bypass middleware-based security (authentication/authorization/rate ...

CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...

CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to...