CVE-2026-14181: @fastify/middie Denial of Service via Malformed URL Encoding

Technical summary

The vulnerability exists in @fastify/middie's URL normalization logic within the standalone engine implementation. When processing incoming request paths, the normalization step invokes a URL decoder on untrusted input without proper exception handling. Malformed percent-encoded sequences—including incomplete escapes (e.g., '%') and truncated UTF-8 multibyte sequences—cause the decoder to throw a synchronous exception. Because the standalone API lacks the exception handling layer provided by the Fastify framework, this unhandled exception propagates up the call stack and terminates the Node.js process. The vulnerability is classified as CWE-248 (uncaught exception), reflecting the failure to guard against or gracefully handle decoder errors. Applications calling middie.run() directly on the standalone engine are vulnerable; those instantiating middie as a Fastify plugin benefit from the framework's top-level error handlers.

Business impact

Organizations relying on @fastify/middie via the standalone engine face a critical availability risk. A single malicious or malformed HTTP request can instantly take down an application server, disrupting all active sessions and services until manual restart. In production environments without robust process management or load balancer failover, this can result in significant downtime. The attack requires no authentication or special privileges—any network-adjacent or Internet-facing instance is exposed. Applications processing user-supplied URLs or handling edge cases in URL encoding are at heightened risk. Dependent services and microservices relying on affected instances may experience cascading failures.

Affected systems

@fastify/middie versions 9.1.0 through 9.3.2 are vulnerable. The vulnerability applies only to applications using the standalone engine API (middie.run() called directly outside the Fastify plugin context). Applications deployed via the Fastify plugin path—the recommended and more common integration pattern—are unaffected because the Fastify framework's error handling layer intercepts the exception. Users should verify their integration method: if middie is registered as middleware within a Fastify application instance, no remediation is required. If the standalone API is in use, immediate patching to version 9.3.3 or higher is necessary.

Exploitability

Exploitability is trivial. An attacker can send a single HTTP request with a malformed URL-encoded payload to trigger a denial of service. The attack requires no authentication, no user interaction, and no special conditions beyond network access to the application. The CVSS 3.1 score of 7.5 (HIGH) reflects the network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and high availability impact (A:H). The attack is reliable and reproducible; examples of triggering payloads include incomplete percent escapes in the path or query string. However, the attack is limited to denial of service—there is no confidentiality or integrity impact, and the attacker cannot execute arbitrary code or access data.

Remediation

The definitive fix is to upgrade @fastify/middie to version 9.3.3 or later. This patch version introduces proper exception handling around the URL normalization step, ensuring that malformed percent-encoded sequences are handled gracefully without terminating the process. For organizations unable to patch immediately, migration to the Fastify plugin integration pattern provides protection; refactoring the application to use middie as a registered plugin within a Fastify app instance allows the framework's error handlers to catch and manage the exception. This workaround may require architectural changes depending on how the standalone API is currently integrated. Testing should confirm that URL decoding errors no longer crash the application and that requests with malformed encoding are handled per the application's error policy.

Patch guidance

Upgrade @fastify/middie to version 9.3.3 or higher via your package manager (e.g., npm update @fastify/middie or yarn upgrade @fastify/middie). After patching, restart affected application instances to ensure the new code is loaded. Verify the patch version in your lock file or dependencies list. If you are using the standalone API, test with known malformed URL payloads (e.g., requests with '%' or truncated UTF-8 sequences in the path) to confirm the application no longer crashes. If adopting the Fastify plugin pattern as a workaround instead, thoroughly test the refactored integration in a staging environment and update your application documentation to reflect the new middleware registration method.

Detection guidance

Monitor application logs and process exit events for unexpected crashes or service restarts correlated with HTTP requests containing unusual URL encodings. Look for error messages or stack traces indicating failures during URL decoding or path normalization within middie. Analyze access logs for requests with incomplete percent escapes (%, %7 without a second hex digit) or non-standard multibyte sequences. Network-level detection tools can flag HTTP requests with malformed percent-encoding in the path or query string as potential exploit attempts. Set up alerting for sudden process terminations in Node.js applications running vulnerable versions of @fastify/middie. After patching, baseline behavior should show these requests handled gracefully (e.g., returning an error response) rather than crashing the server.

Why prioritize this

This vulnerability should be prioritized for immediate patching if you use @fastify/middie's standalone engine API. The combination of effortless exploitability, high availability impact, and widespread deployments of Fastify-based applications creates significant operational risk. Organizations running microservices architectures or containerized deployments where rapid restart masks the issue may face cascading failures or silent service degradation. The fix is straightforward and low-risk, making remediation a priority. Conversely, if your application uses only the Fastify plugin integration, this vulnerability is not actionable and can be deprioritized.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) appropriately captures the risk: the attack is trivial (AV:N, AC:L, PR:N, UI:N) and results in complete service unavailability (A:H), but does not enable data exfiltration or system compromise (C:N, I:N). The scope is unchanged (S:U)—the impact is confined to the affected service. The HIGH severity reflects that denial of service is a serious operational impact. However, the score does not account for context: organizations with robust process orchestration, load balancers, or failover mechanisms may tolerate brief downtime, while those without such protections face acute operational risk. Adjust prioritization based on your deployment model and tolerance for availability loss.

Frequently asked questions