Authorization Bypass in @fastify/middie via Encoded Slash Path Canonicalization Mismatch

CVE-2026-14198 affects @fastify/middie versions 9.1.0 through 9.3.2. The vulnerability is caused by inconsistent path canonicalization between @fastify/middie and Fastify's underlying router. Specifically, @fastify/middie decodes encoded slashes (%2F) inside path parameter values before matching middleware paths, while the router preserves the encoded value during route lookup. Because the middleware layer and router evaluate different effective paths, middleware attached to parameterized paths may fail to run even though the corresponding route handler is successfully matched and executed. In deployments where middleware on parameterized paths is relied upon for authentication, authorization, rate limiting, or auditing, an attacker can send a crafted request containing an encoded slash in the parameter position to bypass those middleware-enforced controls and reach the protected handler.