CVEvulnerability
CVE-2026-6270
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-16
- Last modified
- 2026-06-17
- Assigner
- ce714d77-add3-4f53-aff5-83d477b104bb
- CVSS 3.1 (ce714d77-add3-4f53-aff5-83d477b104bb)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-436
Description
@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.
Affected configurations
• fastify fastify\/middie (< 9.3.2)
Related
Weakness · CWE (1)
- CWE-436 Interpretation Conflict weakness
References
- https://cna.openjsf.org/security-advisories.html Vendor Advisory
- https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c Exploit, Mitigation, Vendor Advisory
- https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w Vendor Advisory