The vulnerability in the @fastify/middie package allows an attacker to bypass authentication and authorization mechanisms. When an application registers authentication middleware in a parent scope, any child plugins that use @fastify/middie fail to inherit that middleware. As a result, routes defined within child plugin scopes can be accessed without authentication, leading to unauthorized data exposure or manipulation. The weakness is a failure to enforce correct policy, identified as CWE-436.

The affected product is @fastify/middie. All versions 9.3.1 and earlier are impacted. The package name is @fastify/middie and the issue is triggered when authentication middleware is registered in a parent Fastify scope and then child plugins are added using @fastify/middie.

The CVSS base score for the vulnerability is 9.1, indicating a high severity with potential for full exploitation. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified; however, the lack of authentication for child plugin routes implies that a remote attacker who can send web requests to the application can easily leverage this flaw to gain unauthenticated access. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high severity and straightforward exploit path increase overall risk for exposed services.