Read the docs
TI-2026-05498 Aliases CVE-2026-6270GHSA-72c6-fx6q-fr5w

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Priority HIGH 74CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00498 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @fastify/middie (@fastify/middie): 9.3.2@fastify/middie (npm): 9.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fastify@fastify/middiebefore 9.3.29.3.2Patch availableCNA
—@fastify/middie (npm)before 9.3.29.3.2Patch availableGHSA-72c6-fx6q-fr5w
  • @fastify/middie Vendorfastify Affected before 9.3.2 Fixed in 9.3.2 Patch available CNA
  • @fastify/middie (npm) Vendor— Affected before 9.3.2 Fixed in 9.3.2 Patch available GHSA-72c6-fx6q-fr5w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:*before 9.3.2Vulnerablefastify
  • cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:* Versions before 9.3.2 Vulnerable ·fastify

Remediation

  • Fix · CNA @fastify/middie (@fastify/middie) Fixed in 9.3.2
  • Fix · GHSA-72c6-fx6q-fr5w @fastify/middie (npm) Fixed in 9.3.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    @fastify/middie 9.3.2

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-26176 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes optionPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6270
  2. 2026-10-03 Alias added: GHSA-72c6-fx6q-fr5w

References

Exploit 1

Advisory 3

Other 1

  • TI-2026-17725 Fastify Middie Middleware Path Bypass CVSS 3.1HIGH 8.8
  • TI-2026-58517 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target CVSS 3.1CRITICAL 9.1
  • TI-2026-12029 @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values CVSS 3.1CRITICAL 9.1
  • TI-2026-26176 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option CVSS 3.1CRITICAL 9.1
  • TI-2026-12013 @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths CVSS 3.1HIGH 7.5
  • TI-2026-02474 @fastify/middie has an improper path normalization vulnerability CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences