EUVD-2026-40947Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated single malformed request triggers the crash (AV:N/AC:L/PR:N/UI:N); impact is availability-only process termination with no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications using the Fastify plugin path are not affected because Fastifys error handler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the exception.
Articles & Coverage 1
AnalysisAI
Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process by sending request paths with malformed percent-encoded sequences. The standalone engine's URL normalization step fails to catch a synchronous decoder exception, terminating the process and taking down all connected clients until manual restart. Only applications that invoke middie.run directly on the standalone engine API are affected; there is no public exploit identified at time of analysis, and no EPSS or KEV data was provided.
Technical ContextAI
@fastify/middie is the Express/Connect-style middleware engine used to run middleware within the Fastify Node.js web framework, and it exposes both a Fastify plugin path and a lower-level standalone engine API. The root cause is classified as CWE-248 (Uncaught Exception): during URL normalization, the underlying percent-decoding routine throws synchronously when it encounters an incomplete percent escape (e.g. a trailing '%') or a truncated multibyte sequence, and middie's normalize step does not wrap this in a try/catch. In the standalone engine path the exception propagates up out of middie.run with no handler, so Node's default behavior terminates the entire process rather than failing a single request.
RemediationAI
Vendor-released patch: upgrade to @fastify/middie 9.3.3, which is the primary and recommended fix. If an immediate upgrade is not possible, the vendor-documented workaround is to migrate from the standalone engine API (middie.run) to the Fastify plugin path, where Fastify's built-in error handler catches the thrown exception and converts it into a normal request-level error instead of a process crash - the trade-off is a code change to your middleware wiring and revalidation that behavior is unchanged. As an additional compensating control, place an upstream reverse proxy or WAF that rejects or normalizes malformed percent-encoded URLs before they reach Node, and ensure a process supervisor (pm2, systemd, container orchestrator) auto-restarts the process to limit outage duration. Refer to the advisory at https://github.com/fastify/middie/security/advisories/GHSA-qcc9-jh8q-47vh for authoritative guidance.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today