@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +6 more potentially affected by CVE-2026-2293 via @nestjs/platform-fastify (>=11.0.1, <=11.1.13)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-2293 Source advisory: OSV:GHSA-R4WM-X892-VJMX...

@ama-sdk/create (>=14.1.0-prerelease.11, <=14.1.0-prerelease.39), @gen-epix/generate-api (0.0.19) +21 more potentially affected by CVE-2026-2293 via @nestjs/core (11.1.13)

@nestjs/core NPM version 11.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/core and may be impacted: - @ama-sdk/create =14.1.0-prerelease.11, =1.0.41, =1.2.0, =1.2.1, =11.14.0, =2.28.1, =0.1.1, =0.15.1 and more Source cves: CVE-2026-2293...

@sync-in/server (2.0.0), homebridge-config-ui-x (>=5.15.3-beta.3, <=5.17.1-beta.3) potentially affected by CVE-2026-2293 via @nestjs/platform-fastify (11.1.13)

@nestjs/platform-fastify NPM version 11.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @sync-in/server 2.0.0 - homebridge-config-ui-x =5.15.3-beta.3, =5.17.1-beta.3 Source cves: CVE-2026-2293 Source...

CVE-2026-2293 NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13...

CVE-2026-2293

Summary: CVE-2026-2293 describes a bypass of authentication/authorization in NestJS apps using @nestjs/platform-fastify when Fastify path-normalization options are enabled. The root cause is a mismatch between middleware evaluation and route dispatch due to differing URL interpretations, allowing...