PT-2026-54639 · Npm · @Fastify/Middie

Jvr2022 + 2 · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-14198

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.1.0 through 9.3.2

Description An authorization bypass occurs because the software decodes the encoded slash %2F within path parameter values before matching middleware paths, whereas the underlying router preserves this encoding during route lookup. This discrepancy allows a request to bypass middleware used for authentication, authorization, rate limiting, or auditing on parameterized paths, enabling an attacker to reach a protected handler using a crafted URL with an encoded slash in the parameter position. This issue is agnostic to the HTTP method and requires no authentication or special preconditions.

Recommendations Upgrade to @fastify/middie version 9.3.3. Avoid using parameterized middleware paths for security decisions. Enforce authentication at the route handler or via a Fastify hook that executes after the router has resolved the request.

Exploit

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2026-14198

GHSA-2V46-JXJM-7Q3V

Affected Products

@Fastify/Middie

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14198.json · Exploit
• https://github.com/fastify/middie/security/advisories/GHSA-2v46-jxjm-7q3v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-14198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-14198 · Security Note
• https://cna.openjsf.org/security-advisories.html · Vendor Advisory
• https://t.me/cveNotify/184715 · Telegram Post
• https://t.me/cveNotify/182267 · Telegram Post
• https://twitter.com/kom_256/status/2072282750778777688 · Twitter Post