@fastify/middie EUVD-2026-40947

Exploitation requires that the target application call middie.run directly on the @fastify/middie standalone engine API (versions 9.1.0-9.3.2) - this specific deployment mode is the essential precondition. The attack itself needs only a single crafted request path containing a malformed percent-encoded sequence (an incomplete percent escape or truncated multibyte sequence); no authentication (PR:N), no user interaction (UI:N), and no non-default network setup are needed once the standalone engine is in use. The primary limiting factor is that applications using the Fastify plugin path are NOT vulnerable, because Fastify's error handler catches the exception - substantially narrowing the real-world exposed population.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is credible: exploitation is network-reachable, low-complexity, unauthenticated, requires no user interaction, and impact is availability-only (no confidentiality or integrity loss). The one material caveat the raw score hides is a deployment precondition - the vulnerable code path only executes for applications that call middie.run directly on the standalone engine API, while the far more common Fastify plugin path is protected by Fastify's framework-level error handler. No EPSS score, KEV listing, or POC was supplied, so there is no evidence of active exploitation; however, the trigger is trivial (a single malformed URL), so weaponization difficulty is very low if a target is running the standalone engine. Net: a genuine high-severity availability issue for the specific standalone-engine population, but likely a small fraction of real deployments - treat as high priority where the standalone API is confirmed in use, and lower priority otherwise.

An attacker who can reach an internet-facing Node.js service built on the @fastify/middie standalone engine sends a single HTTP request with a malformed path such as '/foo%' or a truncated multibyte percent sequence. The decoder throws during normalization, the exception escapes middie.run, and the Node process exits - denying service to every connected client until the app is restarted. No authentication, user interaction, or POC tooling is required, though no public exploit has been identified at time of analysis.