CVE-2026-6270 - Vulnerability Analysis

Overview

@fastify/middie <= 9.3.1 contains a broken access control vulnerability caused by failure to register inherited middleware on child plugin instances, letting unauthenticated requests bypass authentication in child scopes, exploit requires use of child plugins.

Severity & Score

Impact

Unauthenticated attackers can bypass authentication and authorization checks in child plugin routes, potentially accessing protected resources.

Mitigation

Upgrade to @fastify/middie 9.3.2 or later.

References

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fastify-express/security/advisories/GHSA-hrwm-hgmj-7p9c
• https://github.com/fastify/middie/security/advisories/GHSA-72c6-fx6q-fr5w

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 16, 2026

🔴 CVE-2026-6270 - Critical (9.1) @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @FAST... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6270/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner