CVE-2026-6270

OVERVIEW CVE-2026-6270 is an authentication bypass vulnerability affecting @fastify/middie versions 9.3.1 and earlier. The flaw prevents authentication middleware registered in parent application scopes from being properly inherited by child plugin instances. This allows unauthenticated requests to reach protected routes in child plugins, completely circumventing intended authentication and authorization controls. The vulnerability impacts all Fastify applications using @fastify/middie that rely on parent-scope middleware for security. SEVERITY This vulnerability carries a CRITICAL CVSS 3.1 score of 9.1 with a network-based attack vector requiring no authentication or user interaction. The attack has low complexity and affects the entire application scope with no user involvement required. The impact is severe: attackers gain high-level unauthorized access to confidential information and can make unauthorized modifications to application data. While no availability impact is present, the combined confidentiality and integrity compromise makes this a critical issue for any affected deployment. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. Community attention remains minimal with an EPSS score of 0.00058, indicating very low probability of exploitation despite the critical nature. No public exploit code is currently available. However, organizations should prioritize upgrading to version 9.3.2 immediately, as the vulnerability is trivial to exploit and no workarounds exist.