GHSA-72c6-fx6q-fr5w
Critical · 9.1CVSS
9.1
EPSS
—
Published
Apr 16, 2026
CISA due date
—
The record
@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @fastify/middie | 0 | 9.3.2 |
Related vulnerabilities
- CVE-2026-6270 @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly… Same vulnerability
- GHSA-v9ww-2j6r-98q6 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes… Also affects @fastify/middie
- CVE-2026-33804 @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the… Also affects @fastify/middie
- GHSA-8p85-9qpw-fwgw @fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware Also affects @fastify/middie
- CVE-2026-2880 A vulnerability in @fastify/middie versions < 9.2.0 can result in… Also affects @fastify/middie
- GHSA-cxrg-g7r8-w69p Fastify Middie Middleware Path Bypass Also affects @fastify/middie
- CVE-2026-22031 @fastify/middie is the plugin that adds middleware support on steroids to Fastify. Also affects @fastify/middie
- CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that… CWE-436