CVE-2026-6270Disclosure(fastify / fastify\/middie)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch fastify fastify\/middie systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the parent middleware. This allows unauthenticated requests to reach routes defined in child plugin scopes, bypassing authentication and authorization checks. Upgrade to @fastify/middie 9.3.2 to fix this issue. There are no workarounds.

fastify CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c

Vendor / third-party advisories

Weakness type (CWE)

CWE-436

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fastify\/middie

Threat summary

Patch or workaround signal is available
10 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 9 signals
Disclosure: 6 classified signals
General: 1 classified signal
Peaked 5d ago at 3 mentions (2026-04-16); latest day: 1
10 total mentions across 6 days

Affected systems

Vendors

fastify

Products

fastify\/middie

Deep dive

Activity timeline10 mentions / 6d

Signal classification3 categories

Disclosure

660.0%

Patch

330.0%

General

110.0%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-16	3	Disclosure2Patch1
2026-04-17	3	Disclosure2General1
2026-04-18	1	Disclosure1
2026-04-20	1	Patch1
2026-04-27	1	Patch1
2026-04-28	1	Disclosure1

Full discourse10 posts

Upwind Security MDR@UpwindMDR173d
Patch
🚨 Critical - fastify middie auth bypass via middleware inheritance flaw (CVE-2026-6270) @fastify/middie <= 9.3.1 does not inherit middleware into child plugin scopes. Auth defined in parent plugins is not applied to child routes, allowing unauthenticated access and bypass of authentication/authorization checks. 👉 Affected: <= 9.3.1 | Upgrade: 9.3.2
Post summary
The post discloses a critical authentication bypass in Fastify middie (CVE‑2026‑6270) affecting <=9.3.1 and advises upgrading to version 9.3.2.
00050118
237 followersView on X
cvereports@_cvereports165d
Disclosure
CVE-2026-6270: CVE-2026-6270: Authentication Bypass via Middleware Interpretation Conflict in Fastify Middie CVE-2026-6270 is a critical authentication and authorization bypass vulnerability affecting the Fastify ecosystem, specifically `@fastify/midd... https://cvereports.com/reports/CVE-2026-6270
Post summary
The brief notice announces CVE‑2026‑6270, a critical authentication bypass in Fastify’s middie module, but offers only a high‑level description without PoC, exploit details, or remediation information.
0000029
36 followersView on X
Giuseppe Paternicola@giuseppe_1337166d
Patch
🚨 CRITICAL: CVE-2026-6270 (CVSS 9.1) @fastify/middie ≤9.3.1 fails to inherit parent middleware in child plugins, bypassing authentication. Impact: Unauthenticated access to protected routes Fix: Upgrade to 9.3.2 immediately #CVE #Vulnerability #PatchNow https://t.co/RbpYESVs1H
Post summary
Alert confirms CVE-2026-6270 is a critical authentication bypass in Fastify Middie and urges users to upgrade to 9.3.2 immediately.
0000035
27 followersView on X
PulsePatch.io@pulsepatchio175d
Disclosure
Authentication bypass (CVE-2026-6270) identified in `@fastify/middie` affects child plugin scopes. Review `Fastify` configurations. #fastify #nodejs #infosec https://www.pulsepatch.io/posts/cve-2026-6270-fastify-middie-auth-bypass
Post summary
A new authentication bypass CVE–2026–6270 was discovered in @fastify/middie, impacting child plugin scopes; users should review Fastify configurations.
0000057
12 followersView on X
Infoflowcloud@infoflowcloud176d
Disclosure
🚨*CVE* CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authenti… https://www.cve.org/CVERecord?id=CVE-2026-6270 ----- Traducción: CVE-2026-6270 Las… http://infoflow.cloud`
Post summary
CVE‑2026‑6270 is a disclosed flaw in @fastify/middie 9.3.1 and earlier that fails to register inherited middleware on child plugin engine instances.
0000024
71 followersView on X
CVE@CVEnew176d
Disclosure
CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authenti… https://www.cve.org/CVERecord?id=CVE-2026-6270
Post summary
The post announces CVE-2026-6270 for @fastify/middie, detailing that inherited middleware isn't correctly registered in child plugin instances; no PoC, exploit, or patch is referenced.
0000088
57.2K followersView on X
DailyCVE@dailycve176d
General
🔴 @fastify/middie, Middleware Authentication Bypass, #CVE-2026-6270 (Critical) https://dailycve.com/fastify-middie-middleware-authentication-bypass-cve-2026-6270-critical/
Post summary
The tweet announces a critical CVE (CVE‑2026‑6270) related to a middleware authentication bypass in fastify/middie but contains no further technical detail, PoC, or exploit information.
0000034
181 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds177d
Disclosure
CVE-2026-6270 Authentication Bypass in @fastify/middie Versions 9.3.1 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6270
Post summary
The text announces CVE-2026-6270, detailing an authentication bypass in @fastify/middie versions 9.3.1 and earlier, with no evidence of exploitation, patches, or PoC link.
0000039
4.0K followersView on X
0day Signal@0dayPublishing177d
Disclosure
🚨 CVE-2026-6270: @fastify/middie vulnerable to mid... Parent-scope auth middleware silently fails to propagate to child plugins—every route in child scopes becomes a free pas... https://zerodaysignal.com/vulnerability/CVE-2026-6270 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026‑6270, detailing an auth bypass where parent‑scope middleware does not propagate to child plugins, but it does not provide a PoC, exploit code, or patch information.
0000040
218 followersView on X
Ulises Gascón@kom_256177d
Patch
🚨 Critical-severity security fix in @fastify/middie@9.3.2 just released! Patches CVE-2026-6270 — middleware authentication bypass in child plugin scopes https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w
Post summary
Fastify’s middie module released version 9.3.2, fixing CVE-2026-6270, which is a middleware authentication bypass in child plugin scopes, as detailed in the linked advisory.
0000083
5.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fastify	fastify\/middie	-	node.js	-

Explore more

Back to dashboard fastify CVEs fastify\/middie vulnerabilities

What researchers are saying

CVE-2026-6270

Upwind Security MDR[verified]@UpwindMDRPatch

The post discloses a critical authentication bypass in Fastify middie (CVE‑2026‑6270) affecting <=9.3.1 and advises upgrading to version 9.3.2.

Giuseppe Paternicola[verified]@giuseppe_1337Patch

Alert confirms CVE-2026-6270 is a critical authentication bypass in Fastify Middie and urges users to upgrade to 9.3.2 immediately.

cvereports@_cvereportsDisclosure

The brief notice announces CVE‑2026‑6270, a critical authentication bypass in Fastify’s middie module, but offers only a high‑level description without PoC, exploit details, or remediation information.

PulsePatch.io@pulsepatchioDisclosure

A new authentication bypass CVE–2026–6270 was discovered in @fastify/middie, impacting child plugin scopes; users should review Fastify configurations.

Infoflowcloud@infoflowcloudDisclosure

CVE‑2026‑6270 is a disclosed flaw in @fastify/middie 9.3.1 and earlier that fails to register inherited middleware on child plugin engine instances.

CVE@CVEnewDisclosure

The post announces CVE-2026-6270 for @fastify/middie, detailing that inherited middleware isn't correctly registered in child plugin instances; no PoC, exploit, or patch is referenced.

DailyCVE@dailycveGeneral

The tweet announces a critical CVE (CVE‑2026‑6270) related to a middleware authentication bypass in fastify/middie but contains no further technical detail, PoC, or exploit information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE-2026-6270, detailing an authentication bypass in @fastify/middie versions 9.3.1 and earlier, with no evidence of exploitation, patches, or PoC link.