Fastify Middie URL Normalization DoS via Malformed Encoding

CVE-2026-14181 affects @fastify/middie versions 9.1.0 through 9.3.2 and represents a critical availability vulnerability in Node.js web applications. The vulnerability stems from improper exception handling during URL normalization—when the middie middleware encounters malformed percent-encoded sequences in request paths (such as incomplete escape sequences or truncated multibyte characters), the underlying decoder throws a synchronous exception that bypasses middie's error handling. This unhandled exception propagates up and terminates the entire Node.js process, enabling an unauthenticated attacker to cause denial of service with a single crafted HTTP request. Applications directly calling middie.run on the standalone engine API are particularly vulnerable, making this a critical risk for Fastify deployments that depend on this middleware for request processing.

While MITRE ATT&CK technique mappings are not directly provided for this CVE, Casky's security skills powered by Claude AI would detect attack patterns associated with resource exhaustion and application availability disruption. Practitioners using Casky would observe findings related to improper error handling (CWE-248), which manifests as unhandled exceptions in request processing pipelines. Extended reasoning analysis would identify the attack chain: an attacker sends HTTP requests with deliberately malformed URL encodings → the normalization function lacks defensive decoding logic → synchronous exceptions escape handler boundaries → process termination. Security teams would see suspicious patterns of single-request process crashes in their application logs, correlating with unusual URL patterns containing incomplete percent-encoding or non-UTF8 multibyte sequences, enabling rapid detection and mitigation before widespread availability impact.