Vulnerability Report

CVE-2026-6270

Title: Fastify Middie Authentication Bypass

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-6270.

CWE Category CWE-436

Published Date Apr 16, 2026

Modified Date May 14, 2026

Exploit Status Not Found

Score 9.1 CVSS v3.1

Exploit Probability (EPSS)

0.09%

Vulnerability Summary

CVE-2026-6270: @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

Impacted Vendors

openjsf 1

fastify 1

Reference Links

https://cna.openjsf.org/security-advisories.html https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w

CVSS v3.1

Source Entity ce714d77-add3-4f53-aff5-83d477b104bb

Severity CRITICAL

9.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns