By vendor

Fastify vulnerabilities

Known CVEs affecting Fastify products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-14181HIGH 7.5

  A vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 allows an attacker to crash Node.js applications by sending HTTP requests with malformed URL encodings. When the middleware attempts to normalize incoming request paths containing broken percent-encoded sequences—such as incomplete escape codes or truncated multibyte characters—the underlying decoder throws an unhandled exception that terminates the entire process. This causes immediate service unavailability for all connected users until the application restarts. The vulnerability only affects applications using middie's standalone engine API; those using the Fastify plugin integration are protected because Fastify's error handler catches the exception before it propagates.