The vulnerability arises in @fastify/middie’s standalone engine during URL normalization, where malformed percent‑encoded incomplete escapes or truncated multibyte characters trigger a decoder exception that is not handled internally. The exception propagates out of the normalize step, causing the entire Node.js process to terminate and abruptly shutting down the server. This results in a denial of service for all connected clients until the application is restarted. The weakness is a failure to properly handle exceptional conditions (CWE‑248).

All installations of @fastify/middie from version 9.1.0 through 9.3.2 expose the standalone engine API are affected. Applications that invoke middie.run directly with these versions are vulnerable. Configurations that use the Fastify plugin path are not impacted because Fastifys framework error handler intercepts and handles the exception.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% points to a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote: an adversary can send a crafted request containing a malformed percent‑encoded path to any accessible server using the affected engine, causing the process crash.