GHSA-72c6-fx6q-fr5w · Severity: critical · Ecosystem: npm — @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.
Conclusion & alert: CVE-2026-6270 is rated Exploit Available (57.8/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.06%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-04-23 | 0.03% | 0.06% | +0.03% |
| 2 | 2026-04-17 | — | 0.03% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.1 | 3.1 | CRITICAL |
|
3.9 | 5.2 | ce714d77-add3-4f53-aff5-83d477b104bb |
GHSA-72c6-fx6q-fr5w · Severity: critical · Ecosystem: npm — @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| fastify | fastify\/middie | < 9.3.2 | cpe:2.3:a:fastify:fastify\/middie:*:*:*:*:*:node.js:*:* |
| URL | Tags |
|---|---|
| https://cna.openjsf.org/security-advisories.html | Vendor Advisory |
| https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c | Exploit Mitigation Vendor Advisory |
| https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w | Vendor Advisory |