@fastify/middie 存在于子插件作用域内的中间件身份验证绕过漏洞

CVE-2026-6270 影响 @fastify/middie 的 9.3.1 及更早版本。该漏洞在于当将中间件路径传播到子插件范围时，中间件路径被错误地重新添加前缀。当子插件使用与父范围中间件路径重叠的前缀进行注册时，中间件路径会被静默修改，导致无法匹配传入的请求。这会导致受影响的子插件范围内的所有路由（包括嵌套的（孙）范围）的中间件安全控制完全绕过。中间件路径不匹配可能导致敏感数据泄露或未经授权的代码执行。

Applications built with Node.js and utilizing @fastify/middie for middleware management are at risk. This includes applications with complex plugin architectures and those relying heavily on middleware for security enforcement. Shared hosting environments where multiple applications share the same Node.js instance are particularly vulnerable, as a compromise in one application could potentially affect others.

• nodejs / server:

  npm list @fastify/middie

Check for versions prior to 9.3.2. • nodejs / server:

  npm audit @fastify/middie

Run an npm audit to identify the vulnerability. • generic web: Review application logs for unusual request patterns or errors related to middleware execution, particularly within child plugin scopes.

1. 2026-04-16Disclosure

   disclosure

1. 已保留2026-04-14
2. 发布日期2026-04-16
3. EPSS 更新日期2026-04-24

主要的缓解措施是将 @fastify/middie 升级到 9.3.2 或更高版本。此版本通过正确处理将中间件路径传播到子插件范围来修复此问题。如果无法立即升级，请仔细检查子插件的配置，以确保没有中间件路径前缀重叠。还建议在任何插件配置更改后进行彻底的安全测试。