CVE-2026-14181 Details

A denial-of-service vulnerability has been identified in @fastify/middie versions 9.1.0 prior to 9.3.2. The issue arises in the standalone engine when incoming request paths contain malformed percent-encoded sequences, such as incomplete escapes or truncated multibyte characters. This flaw causes the decoder to throw a synchronous URIError, which escapes the normalization step and crashes the Node.js process. As a result, all connected clients experience an immediate denial-of-service until the server is restarted. This vulnerability specifically affects applications that use middie.run directly on the standalone engine API, bypassing Fastify's error handling. In contrast, applications that utilize the Fastify plugin path are not impacted, as Fastify's error handler effectively manages the exception.

Users can upgrade to @fastify/middie version 9.3.3 or later to address this vulnerability. Alternatively, applications can migrate from the standalone engine API to the Fastify plugin path, where the framework's error handler will catch any exceptions.