{"id":"CVE-2026-6270","aliases":["CLSA-2026-1778201074","EUVD-2026-23241","GHSA-72c6-fx6q-fr5w"],"status":"published","title":"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes","description":"@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00498,"percentile":0.43162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-04-16T13:44:46Z","modified":"2026-10-30T19:45:57Z","fixes":[{"ecosystem":"npm","package":"@fastify/middie","fixed_in":["9.3.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@fastify/middie","fixed_in":["8.3.3-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@fastify/middie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.3.1"},{"fixed":"9.3.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@fastify/middie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.3-tuxcare.0"},{"fixed":"8.3.3-tuxcare.1"}]}],"versions":["8.3.3"]},{"source":"osv","ecosystem":"npm","package":"@fastify/middie","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.3.2"}]}]}],"products":[{"vendor":"@fastify/middie","product":"@fastify/middie"},{"vendor":"fastify","product":"fastify\\/middie"}],"references":[{"url":"https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c","tags":["Exploit","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w","tags":["Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6270","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-72c6-fx6q-fr5w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6270.json","tags":["advisory"]},{"url":"https://github.com/fastify/middie","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-6270","title":"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes","description":"@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.","status":"published","published":"2026-04-16T13:44:46.322Z","modified":"2026-04-16T14:24:26.764Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T13:49:53.818886Z"}],"euvd":[{"id":"EUVD-2026-23241","description":"@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.","status":"published","published":"2026-04-16T13:44:46Z","modified":"2026-04-16T14:24:26Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:24:23.841547Z"}],"ghsa":[{"id":"GHSA-72c6-fx6q-fr5w","title":"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes","description":"### Impact\n\n`@fastify/middie` v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fails to match incoming requests.\n\nThis results in complete bypass of middleware security controls for all routes defined within affected child plugin scopes, including nested (grandchild) scopes. Authentication, authorization, rate limiting, and any other middleware-based security mechanisms are skipped. No special request crafting or configuration is required.\n\nThis is the same vulnerability class as [GHSA-hrwm-hgmj-7p9c](https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c) (CVE-2026-33807) in `@fastify/express`.\n\n### Patches\n\nUpgrade to `@fastify/middie` v9.3.2 or later.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","status":"published","published":"2026-04-16T22:29:04Z","modified":"2026-04-16T22:29:06Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:39:55.105822Z"}],"nvd":[{"id":"CVE-2026-6270","description":"@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.","status":"published","published":"2026-04-16T14:16:19.433Z","modified":"2026-06-17T11:00:34.46Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:14.748836Z"}],"osv":[{"id":"CVE-2026-6270","title":"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes","description":"@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.","status":"published","published":"2026-04-16T13:44:46.322Z","modified":"2026-10-28T02:30:34.026178208Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-72c6-fx6q-fr5w","title":"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes","description":"### Impact\n\n`@fastify/middie` v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fails to match incoming requests.\n\nThis results in complete bypass of middleware security controls for all routes defined within affected child plugin scopes, including nested (grandchild) scopes. Authentication, authorization, rate limiting, and any other middleware-based security mechanisms are skipped. No special request crafting or configuration is required.\n\nThis is the same vulnerability class as [GHSA-hrwm-hgmj-7p9c](https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c) (CVE-2026-33807) in `@fastify/express`.\n\n### Patches\n\nUpgrade to `@fastify/middie` v9.3.2 or later.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","status":"published","published":"2026-04-16T22:29:04Z","modified":"2026-07-08T08:14:41.365738249Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"CLSA-2026-1778201074","title":"TuxCare security update for @fastify/middie (1 CVE)","description":"TuxCare rebuilt @fastify/middie to address 1 CVE. Fixed in 8.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:57.820965725Z","updated_at":"2026-11-02T15:43:44.737408Z"}]}}