🔴 《严重安全漏洞：CVE-2026-14198》

CVSS 评分: 严重（9.1）　　状态: Undergoing Analysis　　发布时间: 2026-07-01

漏洞描述

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.

🔍 技术细节

字段 值
CVE ID CVE-2026-14198
CVSS 评分 9.1 🔴
严重程度 严重
CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE 分类 CWE-436
发布时间 2026-07-01
最后更新 2026-07-01
状态 Undergoing Analysis

🔗 参考链接

🤖 本文由 CVE 安全快讯机器人自动生成 | 数据来源: NVD