Cyber Resilience

CVE-2026-14181

Fastify\/Middie 9.1.0 – 9.3.3

Published
01 July 2026
Modified
02 July 2026
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0029 21th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-14181 is a high-severity Uncaught Exception (CWE-248) vulnerability in Fastify Fastify\/Middie. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-11 (Error Handling) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying…

more

decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications using the Fastify plugin path are not affected because Fastifys error handler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the exception.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Malformed input triggers uncaught exception crash in public-facing middleware, enabling direct application exploitation for endpoint DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-6270Same product: Fastify Fastify\/Middie
CVE-2026-33804Same product: Fastify Fastify\/Middie
CVE-2026-14198Same product: Fastify Fastify\/Middie
CVE-2026-22031Same product: Fastify Fastify\/Middie
CVE-2026-2880Same product: Fastify Fastify\/Middie
CVE-2026-7768Same vendor: Fastify
CVE-2026-25224Same vendor: Fastify
CVE-2025-3891Shared CWE-248
CVE-2026-7183Shared CWE-248
CVE-2025-66305Shared CWE-248

Affected Assets

fastify
fastify\/middie
9.1.0 — 9.3.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-11 Error Handling
  • SI-10 Information Input Validation
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires the system to handle exceptions from URL decoding so that malformed percent-encoded sequences cannot terminate the Node.js process.

prevent

Requires validation of incoming request paths to reject incomplete or malformed percent-encoded sequences before they reach the vulnerable decoder in middie.

prevent

Mandates prompt application of the vendor patch (upgrade to @fastify/middie 9.3.3) that eliminates the uncaught-exception flaw in the standalone engine path.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect uncaught exceptions before production deployment.

prevents

Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.

prevents

Application security requirements typically mandate robust error and exception handling.

prevents

Secure architecture principles call for centralized, comprehensive exception management.

prevents

Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.

References