Executive brief
A vulnerability in a popular Node.js middleware library can allow an attacker to crash a web server by sending a specially crafted web request. By including malformed characters in a URL, an attacker can trigger an unhandled error that shuts down the entire application process. This results in a total service outage for all users until the application is manually or automatically restarted.
Technical details
The @fastify/middie standalone engine fails to catch synchronous exceptions thrown by the underlying URI decoder during the URL normalization step. When an incoming request contains malformed percent-encoded sequences (such as incomplete escapes or truncated multibyte sequences), the decoder throws a URIError. In applications calling the standalone engine API (middie.run) directly, this exception escapes the middleware and terminates the Node.js process. This leads to a complete Denial of Service (DoS). Applications using @fastify/middie as a standard Fastify plugin are not affected, as Fastify's internal error handling catches the exception. The issue is resolved in version 9.3.3.
Affected products
- OpenJS Foundation @fastify/middie 9.1.0 - 9.3.2
Timeline
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-01: disclosed: CVE published to NVD
- 2026-07-01: patched: Version 9.3.3 released