GHSA-9C5C-9QCX-Q35Q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

Interpretation Conflict

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: GHSA-9C5C-9QCX-Q35Q...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-9C5C-9QCX-Q35Q...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: SNYK:JS-NESTJSPLATFORMFASTIFY-20510282...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.21-legacy.20261015), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +7 more potentially affected by unknown CVE via @nestjs/platform-fastify (12.0.1)

@nestjs/platform-fastify NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @homebridge/homebridge-apt-pkg =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4,...

@anchan828/nest-redis-session-fastify (>=0.0.46, <=0.0.86), @andreacioni/saml2-nest-lib (0.0.7) +221 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=6.5.2, <=11.1.23)

@nestjs/platform-fastify NPM version =6.5.2, =0.0.46, =0.0.5, =1.0.0, =2.0.0, =0.0.1, =0.0.1, =4.23.1, =2.7.0, =6.3.1, =1.0.0, =1.0.0, =1.0.2 - @chisquare/ntx-core 0.0.1 and more Source cves: CVE-2026-54281 Source advisory: MEND:CVE-2026-54281...

CVE-2026-54281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes API on the Fastify adapter, an unauthenticated clien...

CVE-2026-54281: Incorrect Authorization

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes API on the Fastify adapter, an unauthenticated clien...

Authentication Bypass

@nestjs/platform-fastify is vulnerable to Authentication Bypass. The vulnerability is due to improper route matching between Fastify and NestJS middleware registered through MiddlewareConsumer.forRoutes, which allows an attacker to bypass authentication middleware by appending a trailing slash / ...

Incorrect Authorization

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Incorrect Authorization via the MiddlewareConsumer.forRoutes API on the Fastify adapter. An attacker can gain unauthorized access to...

GHSA-6V32-FJC9-9QF6 Nest: Middleware Bypass on Fastify via Trailing Slash

Impact An authentication bypass vulnerability exists in @nestjs/platform-fastify confirmed on version 11.1.24, the latest available release at time of report. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes API on the Fastify adapter, an unauthenticated client can bypa...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +8 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.23)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: OSV:GHSA-6V32-FJC9-9QF6...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +8 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.23)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: GHSA-6V32-FJC9-9QF6...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @dismissible/nestjs-api (>=1.0.3-alpha.0b30e6d.0, <=2.0.2-canary.2913ba8.0) +9 more potentially affected by CVE-2026-54281 via @nestjs/platform-fastify (>=11.0.1, <=11.1.24)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: CVE-2026-54281 Source advisory: SNYK:JS-NESTJSPLATFORMFASTIFY-17374830...

@anchan828/nest-redis-session-fastify (>=0.0.46, <=0.0.86), @andreacioni/saml2-nest-lib (0.0.7) +220 more potentially affected by CVE-2026-33011 via @nestjs/platform-fastify (>=6.5.2, <=11.1.16)

@nestjs/platform-fastify NPM version =6.5.2, =0.0.46, =0.0.5, =1.0.0, =2.0.0, =0.0.1, =0.0.1, =4.23.1, =2.7.0, =6.3.1, =1.0.0, =1.0.0, =1.0.2 - @chisquare/ntx-core 0.0.1 and more Source cves: CVE-2026-33011 Source advisory: MEND:CVE-2026-33011...

CVE-2026-33011: Always-Incorrect Control Flow Implementation

Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers if they exist. As a...