CVE-2026-6270
Critical
Description
@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.
SeverityCritical
CVSS9.1
Exploit probability—
Product
@fastify/middie
PublishedApr 16, 2026
First seenApr 16, 2026
Weakness typeCWE-436CWE-436
How to fix
Update
- @fastify/middie9.3.2 or later
- fastify fastify\/middie9.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @fastify/middienpm | v < 9.3.2 | 9.3.2 |
| fastify fastify\/middie | v < 9.3.2 | 9.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.