CVE-2026-14181: Fastify/middie DoS Vulnerability

CVE-2026-14181 Overview

CVE-2026-14181 is a denial-of-service vulnerability affecting @fastify/middie versions 9.1.0 through 9.3.2. The flaw exists in the URL normalization step used by the standalone engine. Malformed percent-encoded sequences in request paths cause the underlying decoder to throw synchronously. The exception escapes the middie normalize step and terminates the Node.js process. Applications calling middie.run directly on the standalone engine API become unavailable to all connected clients until restart. Applications using the Fastify plugin path are not affected because the framework error handler catches the exception. The vulnerability is tracked under [CWE-248] (Uncaught Exception).

Critical Impact
A single crafted HTTP request containing an incomplete percent escape or truncated multibyte sequence crashes the entire Node.js process, causing an immediate denial of service for all connected clients.

Affected Products

@fastify/middie version 9.1.0
@fastify/middie versions 9.2.x
@fastify/middie versions 9.3.0 through 9.3.2

Discovery Timeline

2026-07-01 - CVE-2026-14181 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14181

Vulnerability Analysis

The vulnerability resides in the URL normalization step of the @fastify/middie standalone engine. When an incoming request path contains malformed percent-encoded input, the URL decoder throws a synchronous exception. The standalone engine invoked through middie.run does not wrap this decode step in exception-handling logic. The uncaught exception propagates up the call stack and terminates the Node.js process.

The Fastify plugin integration path remains safe. Fastify's own error handler catches the thrown exception before it can crash the runtime. Applications that bypass the plugin architecture and call the standalone engine directly inherit the unguarded behavior.

Attackers require no authentication and no user interaction. A single HTTP request to an exposed endpoint is sufficient to terminate the process serving all clients.

Root Cause

The root cause is an unhandled exception [CWE-248] in the standalone engine's URL normalization routine. Malformed percent-encoded sequences, such as %E0 with a missing continuation byte or an incomplete %2 escape, cause Node.js URL decoding utilities to throw. The middie normalize step does not implement a try/catch guard around this synchronous decode call.

Attack Vector

The attack is remotely exploitable over the network with low complexity. An attacker sends an HTTP request with a malformed URL path, for example GET /%E0%A HTTP/1.1 or GET /path/%2 HTTP/1.1. The malformed sequence triggers the decoder exception during middleware normalization. The Node.js worker process exits and all in-flight requests fail until the service is restarted.

Exploitation requires no privileges and no user interaction. The malformed path can be delivered through any client capable of issuing a raw HTTP request, including curl, custom scripts, or automated scanners.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-qcc9-jh8q-47vh for technical details from the maintainers.

Detection Methods for CVE-2026-14181

Indicators of Compromise

Unexpected termination of Node.js processes running @fastify/middie versions 9.1.0 through 9.3.2, often correlated with HTTP request log entries containing malformed percent-encoded paths.
Access logs showing request paths with truncated escapes such as %E, %2, or incomplete multibyte sequences immediately preceding process exit.
Repeated process restarts by orchestrators such as pm2, systemd, or Kubernetes with exit code indicative of an uncaught exception.

Detection Strategies

Inventory Node.js applications and identify dependencies on @fastify/middie in the 9.1.0 to 9.3.2 range using npm ls @fastify/middie or software composition analysis tooling.
Determine whether the application invokes middie.run on the standalone engine or registers middie as a Fastify plugin. Only the standalone engine path is exploitable.
Correlate process crash events with reverse proxy or load balancer access logs to identify malformed URL patterns preceding downtime.

Monitoring Recommendations

Alert on abnormal process exit rates and restart loops for Node.js services fronted by public HTTP endpoints.
Monitor web application firewall and reverse proxy logs for requests containing malformed percent-encoded paths.
Track dependency drift and flag any deployments still using vulnerable @fastify/middie versions after patch availability.

How to Mitigate CVE-2026-14181

Immediate Actions Required

Upgrade @fastify/middie to version 9.3.3 or later across all affected services using npm install @fastify/middie@9.3.3.
Audit application code for direct calls to middie.run on the standalone engine API and prioritize those services for immediate patching.
Deploy WAF or reverse proxy rules to reject requests containing malformed percent-encoded sequences until patching completes.

Patch Information

The maintainers released @fastify/middie version 9.3.3 to address CVE-2026-14181. The patch wraps the URL normalization step in exception-handling logic so that malformed percent-encoded input is rejected as a client error rather than propagating as an uncaught exception. Full details are available in the GitHub Security Advisory GHSA-qcc9-jh8q-47vh and the OpenJS Foundation Security Advisories.

Workarounds

Migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the decoder exception and returns an HTTP error response instead of terminating the process.
Place a reverse proxy such as nginx or a WAF in front of the application to normalize or reject requests with malformed percent-encoded URL paths before they reach the Node.js runtime.
Add a process.on('uncaughtException') handler as a temporary safety net, understanding this is a stopgap and not a substitute for the official patch.

bash

# Upgrade to the patched version
npm install @fastify/middie@9.3.3

# Verify installed version
npm ls @fastify/middie