Skip to main content

Fastify Middie CVE-2026-6270

| EUVDEUVD-2026-23241 CRITICAL
Interpretation Conflict (CWE-436)
2026-04-16 openjs GHSA-72c6-fx6q-fr5w
Authentication Bypass Fastify Middie
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Patch released
Apr 22, 2026 - 17:31 nvd
Patch available
Patch available
Apr 16, 2026 - 15:01 EUVD
EUVD ID Assigned
Apr 16, 2026 - 14:00 euvd
EUVD-2026-23241
CVE Published
Apr 16, 2026 - 13:44 nvd
CRITICAL 9.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 npm packages depend on @fastify/middie (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 9.3.2.

DescriptionCVE.org

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

Analysis

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

More in Fastify Middie

View all
CVE-2026-14198 CRITICAL
9.1 Jul 01

Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers rea
CVE-2026-22031 HIGH
8.4 Jan 19

Middleware path-matching bypass in @fastify/middie before version 9.1.0 allows authenticated attackers to access protect
CVE-2026-2880 HIGH
8.2 Feb 27

Authentication and authorization bypass in @fastify/middie (Node.js middleware library for Fastify) allows remote unauth
CVE-2026-14181 HIGH
7.5 Jul 01

Denial of service in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers crash the Node.js process
CVE-2026-33804 HIGH
7.4 Apr 16

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplica

Same weakness CWE-436 – Interpretation Conflict

View all
CVE-2024-24754 CRITICAL POC
9.8
CVE-2023-24813 CRITICAL POC
9.8
CVE-2019-19589 CRITICAL POC
9.8
CVE-2025-12816 HIGH POC
8.6
CVE-2026-6322 HIGH POC
7.5
CVE-2019-17596 HIGH POC
7.5
CVE-2023-49284 MEDIUM POC
6.6
CVE-2024-24753 MEDIUM POC
6.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-6270 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy