CVE-2026-14198: @fastify/middie encoded slash bypass on parameterized middleware paths

@fastify/middie versions 9.1.0 through 9.3.2 decode the percent-encoded slash %2F inside path-parameter values before matching middleware paths, while Fastify's underlying router (find-my-way) preserves the encoding during route lookup. The two layers therefore disagree on the canonical request path: middie normalizes /user/a%2Fb/comments to /user/a/b/comments (which no longer matches the guard /user/:id/comments), but the router still matches the route and dispatches to the handler. The result is an HTTP-method-agnostic authentication / authorization bypass: an unauthenticated attacker reaches a protected handler on a parameterized path by embedding an encoded slash in the parameter position.

• Package / component affected: @fastify/middie (lib/engine.js, normalizePathForMatching).
• Affected versions: 9.1.0 – 9.3.2 (confirmed against 9.3.2; fixed in 9.3.3).
• Risk level: Critical. Any application that uses middie middleware for authentication, authorization, rate limiting, or auditing on a parameterized path (e.g. /api/:resource, /user/:id/comments) can have that guard silently bypassed with a single crafted URL. No authentication or preconditions are required and the bypass is HTTP-method agnostic.

Impact Parity

• Disclosed / claimed maximum impact: Authentication/authorization bypass on parameterized middleware paths; an attacker reaches a protected handler without credentials.
• Reproduced impact from this run: A real Fastify + middie server with an API-key auth guard on /user/:id/comments returns 200 {"ok":true,"id":"a/b"} for an unauthenticated request to /user/a%2Fb/comments — the guard is bypassed and the protected handler executes. The same request against the fixed build returns 401 Unauthorized.
• Parity: full. The exact claimed bypass (unauthenticated reach of a protected parameterized-path handler via an encoded slash) was demonstrated through both the Fastify app.inject library entrypoint and a real 127.0.0.1 HTTP server.
• Not demonstrated: This is an authorization/authn bypass, not memory corruption or code execution; no crash or RCE is claimed or reproduced.

Root Cause

In lib/engine.js, every request is normalized for middleware matching via normalizePathForMatching(url, options). In the vulnerable version that function calls:

path = FindMyWay.sanitizeUrlPath(path, options.useSemicolonDelimiter)

sanitizeUrlPath decodes percent-encoded characters, so %2F becomes a literal /. When a guard is registered on a parameterized prefix such as /user/:id/comments (compiled with path-to-regexp, end:false), the decoded path /user/a/b/comments has an extra segment and fails to match the guard's regexp. middie therefore runs zero middleware and Fastify's router — which keeps %2F encoded during lookup — still matches the route /user/:id/comments (with id = "a/b") and dispatches the handler. The guard is skipped.

The fix (commit 61d90cd, "fix(engine): preserve encoded slashes in middleware params", released as 9.3.3) replaces the decoder with find-my-way's safe decoder that preserves reserved characters such as %2F:

const { safeDecodeURI } = require('find-my-way/lib/url-sanitizer')
...
path = safeDecodeURI(path, options.useSemicolonDelimiter).path
path = decodeNestedPercentEncodedBytes(path)   // %25xx -> %xx only

With safeDecodeURI, /user/a%2Fb/comments stays /user/a%2Fb/comments for middleware matching, which matches /user/:id/comments, so the guard runs and blocks unauthenticated requests (401). Ordinary percent-encoded bytes and nested %25xx encodings remain compatible with previous matching behavior, and the malformed percent-encoding 400 handling is preserved.

• Fix commit: 61d90cd0f578367283b486cb95f3b8c14bf3ddbf ("fix(engine): preserve encoded slashes in middleware params", v9.3.3).
• Advisory ref: GHSA-2v46-jxjm-7q3v.

Reproduction Steps

1. The self-contained script is bundle/repro/reproduction_steps.sh. It:
   • Reads bundle/project_cache_context.json and reuses the prepared project cache (repo-vuln-v932 = 9.3.2 vulnerable, repo = 9.3.3 fixed), with an npm install fallback to @fastify/middie@9.3.2 / @fastify/middie@9.3.3 if the cache is absent.
   • Registers a Fastify app with middie, an API-key auth guard on the parameterized middleware path /user/:id/comments, and a protected handler on the same pattern.
   • Exercises the library_api entrypoint via app.inject and a real HTTP server on 127.0.0.1 (raw node http client that preserves %2F) for both the vulnerable and the fixed build.
   • Asserts: vulnerable bypass → 200 (handler reached, guard bypassed); fixed bypass → 401 (guard matches); baseline → 401; allowed (with key) → 200 for both.
2. Expected evidence: the vulnerable build returns 200 {"ok":true,"id":"a/b"} for the unauthenticated /user/a%2Fb/comments request, while the fixed build returns 401 {"error":"Unauthorized"}. A clean divergence proves the bypass and the patch.

Evidence

• Master log: bundle/logs/reproduction_steps.log
• Inject harness results: bundle/artifacts/inject_vuln.json, bundle/artifacts/inject_fixed.json (and bundle/logs/inject_vuln.log, bundle/logs/inject_fixed.log)
• Real HTTP server evidence:
  • bundle/artifacts/http/vuln/server.log, bundle/artifacts/http/vuln/responses.txt
  • bundle/artifacts/http/fixed/server.log, bundle/artifacts/http/fixed/responses.txt
• Runtime manifest: bundle/repro/runtime_manifest.json

Key excerpts (real HTTP server, raw node client preserving %2F):

=== vulnerable-server /user/a%2Fb/comments (NO api key) ===
STATUS:200
{"ok":true,"id":"a/b"}        <-- guard bypassed, protected handler reached

=== fixed-server /user/a%2Fb/comments (NO api key) ===
STATUS:401
{"error":"Unauthorized"}      <-- guard now matches and blocks

=== both builds baseline /user/alice/comments (NO api key) ===
STATUS:401  {"error":"Unauthorized"}   <-- guard works for normal paths

=== both builds /user/a%2Fb/comments (WITH api key) ===
STATUS:200  {"ok":true,"id":"a/b"}     <-- route still matches when allowed

Result summary from the script:

inject  vuln:  baseline=401 bypass=200 allowed=200
inject  fixed: baseline=401 bypass=401 allowed=200
server  vuln:  baseline=401 bypass=200
server  fixed: baseline=401 bypass=401

Environment: Node.js v24.18.0, @fastify/middie 9.3.2 (vulnerable) and 9.3.3 (fixed), Fastify from each workspace's node_modules. The vulnerable lib/engine.js uses FindMyWay.sanitizeUrlPath (decodes %2F); the fixed lib/engine.js uses safeDecodeURI (preserves %2F).

Recommendations / Next Steps

• Upgrade to @fastify/middie@9.3.3 or later immediately. The fix preserves encoded slashes in middleware matching so parameterized guards can no longer be bypassed.
• Audit existing middleware registrations: any guard on a parameterized path (/:param, /api/:resource, /user/:id/...) used for authn/authz/rate-limiting is a candidate bypass surface on vulnerable versions.
• Defense in depth: do not rely solely on middleware for authorization; also enforce authorization inside route handlers, and normalize/reject encoded slashes at the edge where appropriate.
• Regression test: the upstream fix ships test/security-encoded-slash-param-bypass.test.js; keep it in CI. Add cases for additional encodings (%2f lower-case, double-encoded %252F) and method-agnostic checks (POST/PUT/DELETE).

Additional Notes

• Idempotency: reproduction_steps.sh was executed twice consecutively; both runs exited 0 with identical results (vulnerable bypass=200, fixed bypass=401). Servers are started on fixed localhost ports and torn down via trap/SIGTERM, so repeated runs are clean.
• Two surfaces, one bug: the bypass is demonstrated both through the canonical library entrypoint (app.inject, classified as library_api to match the submitted claim surface) and over a real 127.0.0.1 TCP socket with a raw node http client that preserves %2F (curl --path-as-is was also verified to preserve %2F).
• Limitations / edge cases: the bypass requires the guard to be registered on a parameterized path; a static-prefix guard (e.g. /api) is not bypassed by this specific vector. Lower-case %2f is equivalent to %2F for the decoder and is bypassed the same way. The malformed-percent (/%zz) 400 handling is preserved by the fix.