What is the CVSS score of CVE-2026-6270?

CVE-2026-6270 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of @fastify/middie are affected by CVE-2026-6270?

@fastify/middie through version 9.3.1 contains an authentication bypass affecting nested Fastify applications, where unauthenticated attackers can reach protected routes through improper middleware…. A patch is available.

How to fix or mitigate CVE-2026-6270?

Within 24 hours, inventory all systems running @fastify/middie 9.3.1 or earlier and identify which routes depend on parent-scope authentication middleware; prioritize assessment of applications exposed to untrusted networks given public exploit availability. Within 7 days, consult the vendor security advisory for the patched version and redeploy all affected environments. Complete authentication flow verification and access control review within 30 days.

@fastify/middie CVE-2026-6270

EUVD-2026-23241 CRITICAL

Interpretation Conflict (CWE-436)

2026-04-16 openjs

GHSA-72c6-fx6q-fr5w

Authentication Bypass Fastify Middie

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated requests reach protected child routes with no interaction, exposing/altering guarded data (C:H/I:H) but not affecting availability (A:N); scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:39 vuln.today

Analysis Generated

Jul 24, 2026 - 07:39 vuln.today

Patch released

Apr 22, 2026 - 17:31 nvd

Patch available

Apr 16, 2026 - 15:01 EUVD

EUVD ID Assigned

Apr 16, 2026 - 14:00 euvd

EUVD-2026-23241

CVE Published

Apr 16, 2026 - 13:44 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on @fastify/middie (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 9.3.2.

DescriptionCVE.org

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

AnalysisAI

Authentication bypass in @fastify/middie 9.3.1 and earlier lets unauthenticated attackers reach protected routes because inherited middleware is not registered directly on child plugin engine instances. When a Fastify app defines auth/authz middleware in a parent scope and mounts child plugins through middie, those child-scope routes silently skip the parent's checks, exposing them to anyone. Rated CVSS 9.1; SSVC lists a public PoC and total technical impact, though EPSS is only 0.03% and there is no evidence of active exploitation.

Technical ContextAI

@fastify/middie is the connect-style middleware engine that adds Express/Connect-compatible .use() middleware support to the Fastify web framework (Node.js). Fastify uses an encapsulation model where child plugins get their own isolated engine instance; the defect is that middie fails to propagate (re-register) parent-scope middleware onto those child engine instances, so route handlers in encapsulated child plugins execute without the guard functions the developer expected to run. This maps to CWE-436 (Interpretation Conflict): the mismatch between Fastify's plugin-encapsulation semantics and how middie registers middleware means a control the developer believed applied globally is silently scoped away. A closely related OpenJS advisory (GHSA-hrwm-hgmj-7p9c) documents the sibling package @fastify/express (<=4.0.4, fixed 4.0.5), where the same class of bug manifests as middleware path-doubling (e.g. /admin inherited into a /admin-prefixed child becomes /admin/admin), producing the same net effect - child-scope routes bypass parent middleware.

RemediationAI

Vendor-released patch: upgrade @fastify/middie to 9.3.2 (and, if you also use @fastify/express, upgrade to 4.0.5). The vendor explicitly states there are no workarounds, so patching is the only reliable fix. Until you can upgrade, the practical compensating control is to stop relying on parent-scope middleware inheritance for security: re-register the authentication/authorization middleware explicitly inside each child plugin scope (so the guard runs on the child engine instance directly), or move auth enforcement to a Fastify-native mechanism such as an onRequest/preHandler hook registered per-scope, which does encapsulate correctly. The trade-off is added boilerplate and the risk of missing a scope, so treat it as a stopgap and complete the upgrade. Refer to the advisories at https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w and https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c.