Skip to content
OpenAdvisories

Vendor

@fastify/middie

7 known vulnerabilities.

Products

@fastify/middie 7
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-14181

    @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths

    @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte s…

    @fastify/middie @fastify/middie
  • High 7.4
    CVE-2026-33804

    @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

    @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's r…

    @fastify/middie @fastify/middie @fastify/middie npm
  • High 8.2
    CVE-2026-2880

    @fastify/middie has an improper path normalization vulnerability

    A vulnerability in @fastify/middie versions < 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware (for example, app.use('/secret', auth)). When Fastify router normalization options are enabled (such as ignoreDuplicateSlas…

    @fastify/middie @fastify/middie @fastify/middie npm