CVE-2026-14198: @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

Synopsis

An authorization bypass vulnerability affects @fastify/middie versions 9.1.0 through 9.3.2, a middleware compatibility layer for the Fastify Node.js web framework. The flaw is reachable over the network with no authentication required: an attacker sends a single HTTP request containing a percent-encoded slash (%2F) in a path parameter, causing the middleware layer to skip security checks that the underlying route handler still executes. Successful exploitation lets an attacker read protected resources or tamper with data that middleware-enforced authentication, authorization, or rate limiting was meant to guard. A patched-image rebuild at version 9.3.3 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Fastify service over the network; no local or physical access is needed, and the crafted request can be sent from anywhere the service is exposed.

• AuthenticationNot required

  No credentials or session are needed; the bypass works on unauthenticated HTTP requests across all methods.

• Victim interactionNot required

  No user action is required; the attacker sends the crafted URL directly to the server without any social-engineering step.

• Attack complexityDetail

  Exploitation is reliable and condition-free: sending a single request with %2F in the path parameter position is sufficient, with no timing dependency or environmental prerequisite.

Blast Radius

• An attacker bypasses middleware-enforced authentication or authorization checks and reaches route handlers that were intended to be protected.
• Protected data exposed to the handler (session tokens, user records, configuration endpoints) becomes readable without presenting valid credentials.
• An attacker can issue write or delete operations through protected handlers, modifying persisted data that authorization middleware was meant to block.
• Rate-limiting and auditing middleware is also bypassed, enabling unthrottled requests and leaving no audit trail for the access.