CVE-2026-6270 PUBLISHED

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Assigner: openjs
Reserved: 14.04.2026 Published: 16.04.2026 Updated: 16.04.2026

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Product Status

Vendor @fastify/middie
Product @fastify/middie
Versions Default: unaffected
  • affected from 0 to 9.3.2 (excl.)
  • Version 9.3.2 is unaffected

Credits

  • FredKSchott reporter
  • climba03003 remediation developer
  • UlisesGascon remediation developer

References

Problem Types

  • CWE-436: Interpretation Conflict CWE