CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
Attackers can bypass authentication in child plugin scopes by exploiting middleware inheritance flaws in @fastify/middie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6270?
CVE-2026-6270 is a critical authentication bypass vulnerability in @fastify/middie, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.
Weakness: CWE-436
Which versions are affected by CVE-2026-6270?
2 open source packages ship an affected version, including @fastify/middie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/middie npm | All versions | 9.3.2 |
@fastify/middie npm | All versions | 9.3.2 |
Products include Fastify Fastify\/Middie.
How do I fix CVE-2026-6270?
Upgrade @fastify/middie to 9.3.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-6270 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6270 exists.
Other vulnerabilities in @fastify/middie
- CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
- CVE-2026-14198 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
- CVE-2026-22031 Fastify Middie Middleware Path Bypass
- CVE-2026-2880 @fastify/middie has an improper path normalization vulnerability
- CVE-2026-14181 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths
Sources
Also known as CLSA-2026-1778201074, GHSA-72c6-fx6q-fr5w.