by Kastro
Paper/Archive/CVE-2026-6270

CVE-2026-6270

@fastify/middie @fastify/middie — @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.7.427 × 208.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

Affected

ProductAffectedFixed inSource
@fastify/middie< 9.3.29.3.2CNA

Scores by source

openjs (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9crefgithub.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5wrefcna.openjsf.org/security-advisories.html