p PatchFirst

CVE-2026-6270

CVE-2026-6270 · @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

CVSS 9.1 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • @fastify/middie

    Versions
    • ≥ 0, < 9.3.2: Affected (semver)
    • 9.3.2: Not affected (semver)

    Update to 9.3.2

  • @fastify/middie npm

    Affected ranges
    • SEMVER: < 9.3.2

    Update to 9.3.2

Original sources

Check your server →