CVE-2026-14198— Fastify @fastify/middie 处理逻辑错误漏洞

@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

解释冲突

Fastify @fastify/middie 处理逻辑错误漏洞

Fastify @fastify/middie是Fastify团队开源的一个中间件引擎。 Fastify @fastify/middie 9.1.0版本至9.3.2版本存在处理逻辑错误漏洞，该漏洞源于在处理路径参数值时对编码的斜杠%2F解码与路由查找时保留编码不一致，导致中间件无法匹配路由处理器所匹配的URL，当中间件用于参数化路径上的身份验证、授权、速率限制或审计时，攻击者可通过发送单个含编码斜杠的特制URL绕过保护。

N/A

N/A