Executive brief
NestJS applications using the Fastify platform adapter can be bypassed when security middleware is applied to specific routes. An attacker can use URL encoding tricks (e.g., `/%61dmin` for `/admin`) to avoid middleware checks while still accessing protected endpoints, leading to unauthorized access to authentication, authorization, and validation controls. This can allow unauthenticated users to access administrative functions or restricted resources.
Technical details
This is a time-of-check time-of-use (TOCTOU) race condition vulnerability in NestJS's Fastify platform adapter. The root cause is inconsistent URL decoding between the middleware routing logic and the actual route handler execution. When middleware is configured to protect specific routes using string paths (e.g., `.forRoutes('admin')`), the middleware matching logic does not decode URL-encoded characters, but the subsequent controller routing does. An attacker can send requests with URL-encoded path segments (e.g., `/%61dmin` instead of `/admin`, where `%61` is the hex encoding for 'a') to bypass middleware checks while still reaching the target controller. This affects applications relying on NestMiddleware for security checks via MiddlewareConsumer or app.use(). The vulnerability is patched in @nestjs/platform-fastify version 11.1.11 and later.
Affected products
- NestJS platform-fastify < 11.1.11
Timeline
- 2025-12-29: disclosed
- 2025-12-30: patched: Fixed in @nestjs/platform-fastify 11.1.11