CVE-2026-6270: @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.
Other sources
Impact
@fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fails to match incoming requests.
This results in complete bypass of middleware security controls for all routes defined within affected child plugin scopes, including nested (grandchild) scopes. Authentication, authorization, rate limiting, and any other middleware-based security mechanisms are skipped. No special request crafting or configuration is required.
This is the same vulnerability class as GHSA-hrwm-hgmj-7p9c (CVE-2026-33807) in @fastify/express.
Patches
Upgrade to @fastify/middie v9.3.2 or later.
Workarounds
None. Upgrade to the patched version.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@fastify/middieto a version that resolves this vulnerability.Fixed in 9.3.2 - Upgrade
Upgrade
@fastify/middieto a version that resolves this vulnerability.Fixed in 9.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6270?
The severity of CVE-2026-6270 is classified as high due to the potential for bypassing authentication in Fastify applications.
How do I fix CVE-2026-6270?
To fix CVE-2026-6270, upgrade to @fastify/middie version 9.3.2 or later where the middleware authentication issue has been resolved.
What versions are affected by CVE-2026-6270?
CVE-2026-6270 affects @fastify/middie versions 9.3.1 and earlier.
What is the impact of CVE-2026-6270 on Fastify applications?
CVE-2026-6270 can lead to unauthorized access as it allows authentication bypass for middleware defined in parent plugin scopes.
Is CVE-2026-6270 related to any other vulnerabilities?
CVE-2026-6270 is specific to the @fastify/middie package and does not directly reference other vulnerabilities but addresses a critical security flaw in middleware handling.