CVE-2026-6270CWE-436

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Critical · published April 16, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00608 · 48.4th percentile
Weakness
CWE-436 · Interpretation Conflict
Published
2026-04-16T13:44Z
EPSS history
Timeline
  • 16 APR 13:44Z
    @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
    cvelistv5