@fastify/middie CVE-2026-6270

The exploitable state is a developer/deployment prerequisite, not an attacker prerequisite: the Fastify application must register authentication or authorization middleware in a parent scope via @fastify/middie AND define the protected routes inside encapsulated child plugins that expect to inherit that middleware. Where that pattern exists, exploitation needs no special conditions - remote unauthenticated requests against default configurations of @fastify/middie reach the child routes with no credentials, user interaction, or non-default settings. What LIMITS exploitation: applications that do not use middie-based parent-scope middleware for security, that enforce auth via per-scope hooks, or that place auth middleware within the same scope as the routes are not vulnerable; the impact is confidentiality/integrity of the exposed routes (A:N, no availability effect).

Signals are mixed and should be weighed rather than taken at face value. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N = 9.1) and SSVC's 'Technical Impact: total' both point to a serious, network-reachable auth bypass with no attacker prerequisites, and SSVC confirms 'Exploitation: poc'. However, EPSS is very low (0.03%, 7th percentile) and SSVC marks 'Automatable: no', and the vulnerability is NOT in CISA KEV - so this is currently a publicly-known-but-not-observed-in-the-wild issue rather than a mass-exploited one. Critically, the raw CVSS overstates universality: exploitation depends entirely on a specific application architecture (parent-scope middleware + middie-mounted child plugins). Apps that don't rely on parent-scope middleware for auth, or that don't use middie encapsulation this way, are unaffected. So the honest read is high-severity WHERE the vulnerable pattern exists, but not a blanket 9.1 for every deployment. No public exploit identified as weaponized; only PoC-level code per SSVC.

An attacker enumerates a Fastify-based API and sends a plain HTTP request directly to a sensitive route defined inside a child plugin (e.g. GET /admin/users) without any credentials. Because the parent-scope auth middleware was never registered on the child engine instance, the request is served without ever hitting the authentication check, returning protected data. A PoC exists (SSVC: poc; the sibling @fastify/express advisory includes working demo code), so exploitation is trivial once the vulnerable route pattern is identified.