CVE-2026-14198: Fastify @fastify/middie authorization bypass via encoded slash in path parameters

CVE-2026-14198 · Severity: critical · CVSS 9.1 · Published 2026-07-01

A vulnerability in the @fastify/middie library, which allows Fastify web applications to use traditional middleware, can lead to security bypasses. Because the library and the main web server disagree on how to read certain web addresses containing encoded slashes, security checks like login requirements or rate limits may be skipped. An attacker can exploit this to access restricted data or administrative functions without any prior authentication.

Technologies: Fastify Middie. Vendors: Fastify.

Quick answers

Is CVE-2026-14198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14198 being exploited in the wild.
How severe is CVE-2026-14198?
Critical severity, with a CVSS score of 9.1, published 1 July 2026.
Which products and versions are affected?
Fastify Middie 9.1.0 - 9.3.2.
Is there a fix for CVE-2026-14198?
A patch was published on 2026-07-01: Version 9.3.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14198 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-14198?
Check whether you run Fastify Middie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An interpretation conflict (CWE-436) exists in @fastify/middie where the library decodes encoded slashes (%2F) within path parameters before matching middleware, while the underlying Fastify router preserves them. This discrepancy allows a crafted URL (e.g., /user/a%2Fb/comments) to bypass middleware intended for that path (e.g., /user/:id/comments) while still reaching the intended route handler. This bypass affects any security-critical middleware including authentication, authorization, and rate limiting. The vulnerability is reachable over the network without authentication. Users should upgrade to version 9.3.3 or move security logic to Fastify hooks like preHandler.

Affected products

  • Fastify @fastify/middie 9.1.0 - 9.3.2

Timeline

  • 2026-06-30: advisory: GitHub Security Advisory published
  • 2026-07-01: disclosed: NVD publication date
  • 2026-07-01: patched: Version 9.3.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.