Authentication bypass in @fastify/middie and @fastify/express (CVE-2026-6270)

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances, allowing unauthenticated requests to reach routes defined in child plugin scopes and bypass authentication and authorization checks. @fastify/express v4.0.4 contains a related path-doubling bug in its onRegister function: middleware paths are doubled when inherited by child plugins, causing Express middleware security controls to be silently bypassed for all routes within child plugin scopes that share a prefix with parent-scoped middleware. No special configuration is required to trigger the @fastify/express issue; no workarounds exist for the @fastify/middie vulnerability. Affected versions: - @fastify/express <= 4.0.4 We recommend updating to: @fastify/express 4.0.5. CVSS 9.1 · our assessment: act_now Reference: https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c Details: https://vuln.today/cve/CVE-2026-6270