What is CVE-2026-14198?

CVE-2026-14198 is a critical-severity vulnerability in @Fastify/middie, classified under CWE-436. CVSS score: 9.1/10. Published 2026-07-01.

How severe is CVE-2026-14198?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in @Fastify/middie

CVE-2026-14198

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree…

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

@Fastify/middie — versions 9.1.0, 9.3.3

Weakness classification (CWE)

CWE-436

References

ce714d77-add3-4f53-aff5-83d477b104bb
ce714d77-add3-4f53-aff5-83d477b104bb

Frequently asked questions

What is CVE-2026-14198?: CVE-2026-14198 is a critical-severity vulnerability in @Fastify/middie, classified under CWE-436. CVSS score: 9.1/10. Published 2026-07-01.
How severe is CVE-2026-14198?: Critical severity. CVSS v3 base score is 9.1 out of 10.