Middleware Inheritance Issue in Fastify Plugins by Fastify

CVE-2026-6270

What is CVE-2026-6270?

@fastify/middie versions 9.3.1 and earlier are susceptible to a vulnerability that prevents inherited middleware from being registered on child plugin instances. This flaw occurs when an authentication middleware is registered in a parent scope, but child plugins fail to inherit this middleware, allowing unauthenticated requests to bypass necessary authentication and authorization checks in child plugin routes. Upgrading to @fastify/middie version 9.3.2 is essential to resolve this issue, as there are currently no available workarounds.

References