CVE-2026-6270: @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Published Apr 16, 2026
·
Updated

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

Other sources

Impact

@fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fails to match incoming requests.

This results in complete bypass of middleware security controls for all routes defined within affected child plugin scopes, including nested (grandchild) scopes. Authentication, authorization, rate limiting, and any other middleware-based security mechanisms are skipped. No special request crafting or configuration is required.

This is the same vulnerability class as GHSA-hrwm-hgmj-7p9c (CVE-2026-33807) in @fastify/express.

Patches

Upgrade to @fastify/middie v9.3.2 or later.

Workarounds

None. Upgrade to the patched version.

GitHub

Affected Software

3 affected componentsFixes available
npm/@fastify/middie<=9.3.1
npm/@fastify/middie<=9.3.1
9.3.2
fastify Fastify\/middie Node.js<9.3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/@fastify/middie to a version that resolves this vulnerability.

    Fixed in 9.3.2
  2. Upgrade

    Upgrade @fastify/middie to a version that resolves this vulnerability.

    Fixed in 9.3.2

Event History

Apr 16, 2026
CVE Published
via MITRE·01:44 PM
Data Sourced
via MITRE·01:44 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
Affected Software
Advisory Published
via GitHub·10:29 PM
Data Sourced
via GitHub·10:29 PM
DescriptionSeverityWeaknessAffected Software
May 21, 58279
Event
via FIRST·09:35 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-6270?

The severity of CVE-2026-6270 is classified as high due to the potential for bypassing authentication in Fastify applications.

2

How do I fix CVE-2026-6270?

To fix CVE-2026-6270, upgrade to @fastify/middie version 9.3.2 or later where the middleware authentication issue has been resolved.

3

What versions are affected by CVE-2026-6270?

CVE-2026-6270 affects @fastify/middie versions 9.3.1 and earlier.

4

What is the impact of CVE-2026-6270 on Fastify applications?

CVE-2026-6270 can lead to unauthorized access as it allows authentication bypass for middleware defined in parent plugin scopes.

5

Is CVE-2026-6270 related to any other vulnerabilities?

CVE-2026-6270 is specific to the @fastify/middie package and does not directly reference other vulnerabilities but addresses a critical security flaw in middleware handling.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203