Executive Summary

The vulnerability exists in @fastify/middie versions 9.3.1 and earlier, where inherited middleware is not properly registered on child plugin engine instances.

When a Fastify application registers authentication middleware in a parent scope and then registers child plugins using @fastify/middie, the child plugins do not inherit the authentication middleware from the parent.

This flaw allows unauthenticated requests to access routes defined in child plugin scopes, effectively bypassing authentication and authorization checks.

Upgrading to @fastify/middie version 9.3.2 fixes this issue. There are no known workarounds.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass authentication and authorization controls on routes defined in child plugin scopes of a Fastify application.

As a result, unauthorized users may gain access to sensitive or restricted resources, potentially leading to data breaches or unauthorized actions within the application.

Given the CVSS score of 9.1, the impact is considered high, with confidentiality and integrity being severely affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade @fastify/middie to version 9.3.2 or later.

There are no workarounds available for this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated requests to bypass authentication and authorization checks in child plugin scopes of a Fastify application. Such unauthorized access could lead to exposure of sensitive data or unauthorized actions.

By permitting unauthorized access, this issue could potentially lead to non-compliance with standards and regulations that require strict access controls and protection of sensitive information, such as GDPR and HIPAA.

However, the provided information does not explicitly mention compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0