@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-NESTJSPLATFORMFASTIFY-20510282...

Interpretation Conflict

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: GHSA-9C5C-9QCX-Q35Q...

GHSA-9C5C-9QCX-Q35Q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-9C5C-9QCX-Q35Q...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

@anchan828/nest-redis-session-fastify (>=0.0.46, <=0.0.86), @andreacioni/saml2-nest-lib (0.0.7) +221 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=6.5.2, <=11.1.23)

@nestjs/platform-fastify NPM version =6.5.2, =0.0.46, =0.0.5, =1.0.0, =2.0.0, =0.0.1, =0.0.1, =4.23.1, =2.7.0, =6.3.1, =1.0.0, =1.0.0, =1.0.2 - @chisquare/ntx-core 0.0.1 and more Source cves: CVE-2026-54281 Source advisory: MEND:CVE-2026-54281...

CVE-2026-54281: Incorrect Authorization

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes API on the Fastify adapter, an unauthenticated clien...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +8 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.23)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: GHSA-6V32-FJC9-9QF6...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +8 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.23)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: OSV:GHSA-6V32-FJC9-9QF6...

GHSA-6V32-FJC9-9QF6 Nest: Middleware Bypass on Fastify via Trailing Slash

Impact An authentication bypass vulnerability exists in @nestjs/platform-fastify confirmed on version 11.1.24, the latest available release at time of report. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes API on the Fastify adapter, an unauthenticated client can bypa...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +9 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.24)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: SNYK:JS-NESTJSPLATFORMFASTIFY-17374830...

Incorrect Authorization

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Incorrect Authorization via the MiddlewareConsumer.forRoutes API on the Fastify adapter. An attacker can gain unauthorized access to...

org.webjars.npm:nestjs__platform-express (>=8.4.7, <=9.0.0-next.2) potentially affected by CVE-2026-5079 via org.webjars.npm:multer (1.4.4-lts.1)

org.webjars.npm:multer MAVEN version 1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2026-5079 Source advisory:...

@anchan828/nest-redis-session-fastify (>=0.0.46, <=0.0.86), @andreacioni/saml2-nest-lib (0.0.7) +220 more potentially affected by CVE-2026-33011 via @nestjs/platform-fastify (>=6.5.2, <=11.1.16)

@nestjs/platform-fastify NPM version =6.5.2, =0.0.46, =0.0.5, =1.0.0, =2.0.0, =0.0.1, =0.0.1, =4.23.1, =2.7.0, =6.3.1, =1.0.0, =1.0.0, =1.0.2 - @chisquare/ntx-core 0.0.1 and more Source cves: CVE-2026-33011 Source advisory: MEND:CVE-2026-33011...

CVE-2026-33011 Nest Fastify HEAD Request Middleware Bypass

Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers if they exist. As a...

CVE-2026-33011: Always-Incorrect Control Flow Implementation

Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers if they exist. As a...