fix(deps): update dependency @nestjs/platform-fastify to v11 [security] by renovate[bot] · Pull Request #882 · mogland/core

renovate · 2025-12-30T17:57:18Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nestjs/platform-fastify (source)	`10.2.10` → `11.1.24`

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

CVE-2025-69211 / GHSA-8wpr-639p-ccrj

More information

Details

A NestJS application is vulnerable if it meets all of the following criteria:

Platform: Uses @nestjs/platform-fastify.
Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')).
Example Vulnerable Config:

// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // Security check
      .forRoutes('admin');   // Vulnerable: Path-based restriction
  }
}

Attack Vector:

Target Route: /admin
Middleware Path: admin
Attack Request: GET /%61dmin
Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.

Consequences:

Authentication Bypass: Unauthenticated users can access protected routes.
Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
Input Validation Bypass: Middleware performing sanitization or validation can be skipped.

Patches

Patched in @nestjs/platform-fastify@11.1.11

Resources

Credit goes to Hacktron AI for reporting this issue.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nest has a Fastify URL Encoding Middleware Bypass

CVE-2026-2293 / GHSA-r4wm-x892-vjmx

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options (e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.

The bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.

Nest passes Fastify routerOptions (such as ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.

But middleware execution is decided by a separate regex check over req.originalUrl in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.

If that regex does not match, Nest does next() and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.

This is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.

Patches

Fixed in @nestjs/platform-fastify@11.1.14

References

Credit goes to Fluidattacks (Cristian Vargas) https://fluidattacks.com/advisories/neton

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nest Fastify HEAD Request Middleware Bypass

CVE-2026-33011 / GHSA-wf42-42fg-fg84

More information

Details

Impact

In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).

As a result:

Middleware will be completely skipped.
The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
The actual handler will still be executed.

Patches

Fixed in @nestjs/platform-fastify@11.1.16

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nest: Middleware Bypass on Fastify via Trailing Slash

CVE-2026-54281 / GHSA-6v32-fjc9-9qf6

More information

Details

Impact

An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.

This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.

Patches

Fixed in @nestjs/platform-fastify@11.1.24

References

Kudos goes to @a-tt-om

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nestjs/nest (@nestjs/platform-fastify)

Conversation

renovate Bot commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

Details

Patches

Resources

Severity

References

Nest has a Fastify URL Encoding Middleware Bypass

Details

Impact

Patches

References

Severity

References

Nest Fastify HEAD Request Middleware Bypass

Details

Impact

Patches

Severity

References

Nest: Middleware Bypass on Fastify via Trailing Slash

Details

Impact

Patches

References

Severity

References

Release Notes

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v11.1.23 (2026-05-21)

Bug fixes

Committers: 1

v11.1.22 (2026-05-21)

Bug fixes

Enhancements

Committers: 2

v11.1.21 (2026-05-14)

Bug fixes

Committers: 1

v11.1.20 (2026-05-13)

Bug fixes

Enhancements

Dependencies

Committers: 13

v11.1.19 (2026-04-13)

Bug fixes

Committers: 2

v11.1.18 (2026-04-03)

Bug fixes

Dependencies

Committers: 6

v11.1.17 (2026-03-16)

Enhancements

Bugs

Dependencies

Committers: 3

v11.1.16 (2026-03-05)

Bug fixes

Dependencies

Committers: 2

What's Changed

New Contributors

v11.1.14 (2026-02-17)

Bug fixes

Enhancements

Committers: 5

v11.1.13 (2026-02-03)

Bug fixes

Enhancements

Dependencies

Committers: 6

v11.1.12 (2026-01-15)

Bug fixes

Dependencies

renovate Bot commented Dec 30, 2025 •

edited

Loading