p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @nestjs/platform-fastify

In den letzten 30 Tagen veröffentlichte Sicherheitslücke für @nestjs/platform-fastify: 1. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 5

  1. GHSA-9c5c-9qcx-q35q

    Hoch · CVSS 7.4Korrektur verfügbar

    @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

    | Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/platform-fastify` | | Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` | | Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) | ### Summary On the Fastify adapter, an HTTP request that uses an **absolute-form request target** (`GET http://host/path HTTP/1.1` instead of `GET /path HTTP/1.1`) reaches the route handler without running the path-scoped Nest middleware bound to that route. Applications that enforce authentication or authorization in middleware execute the protected handler with those checks skipped. ### Impact Any application

    @nestjs/platform-fastify @nestjs/platform-fastifyNode.js
    • Auf 11.2.4 aktualisieren
    • Auf 12.0.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-54281

    Hoch · CVSS 8.7EPSS 0,5%Korrektur verfügbar

    Nest: Middleware Bypass on Fastify via Trailing Slash

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.

    @nestjs/platform-fastifyNode.js
    • Auf 11.1.24 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2026-33011

    Hoch · CVSS 8.7EPSS 0,35%Korrektur verfügbar

    Nest Fastify HEAD Request Middleware Bypass

    Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: middleware will be completely skipped, the HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler), and the actual handler will still be executed. This issue is fixed in version 11.1.16.

    @nestjs/platform-fastifyNode.js
    • Auf 11.1.16 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-2293

    Hoch · CVSS 8.2EPSS 0,76%Korrektur verfügbar

    NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass

    A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

    @nestjs/platform-fastifyNode.js
    • Auf 11.1.14 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2025-69211

    Mittel · CVSS 6.9EPSS 0,38%Korrektur verfügbar

    Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

    Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware perfo

    @nestjs/platform-fastifyNode.js
    • Auf 11.1.11 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →