Is CVE-2026-2293 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2293 being exploited in the wild.

How severe is CVE-2026-2293?

Critical severity, with a CVSS score of 9.8, published 27 February 2026.

Which products and versions are affected?

NestJS 11.1.13; @nestjs/platform-fastify (npm) SEMVER:introduced=0,fixed=11.1.14.

Is there a fix for CVE-2026-2293?

Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2293 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-2293?

Check whether you run NestJS Nest, NestJS or @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2293: NestJS auth bypass in @nestjs/platform-fastify

CVE-2026-2293 · Severity: critical · CVSS 9.8 · Published 2026-02-27

NestJS is a popular framework for building server-side web applications. A security flaw in its Fastify integration allows attackers to bypass security checks like login requirements or permission controls. This could lead to unauthorized access to sensitive data or administrative functions by simply manipulating the web address used to access the application.

Technologies: NestJS Nest, @nestjs/platform-fastify (npm). Vendors: NestJS, npm.

Quick answers

Is CVE-2026-2293 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2293 being exploited in the wild.
How severe is CVE-2026-2293?: Critical severity, with a CVSS score of 9.8, published 27 February 2026.
Which products and versions are affected?: NestJS 11.1.13; @nestjs/platform-fastify (npm) SEMVER:introduced=0,fixed=11.1.14.
Is there a fix for CVE-2026-2293?: Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2293 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-2293?: Check whether you run NestJS Nest, NestJS or @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nestjs/platform-fastify (npm): upgrade to 11.1.14 or later
```
npm install @nestjs/platform-fastify@11.1.14
```

Technical details

An authentication and authorization bypass vulnerability exists in NestJS when using the @nestjs/platform-fastify adapter. The issue stems from a discrepancy in how paths are handled between NestJS middleware and the underlying Fastify engine when path-normalization options are enabled (CWE-551). Specifically, an attacker can craft a URL that bypasses security guards or middleware but is still routed to a protected controller by the underlying engine. This allows unauthenticated remote attackers to access restricted endpoints. The vulnerability is addressed in NestJS version 11.1.14.

Affected products

nestjs nest.js 11.1.13

Identifiers

CVE-2026-2293
GHSA-r4wm-x892-vjmx

Timeline

2026-02-17: patched: Version 11.1.14 released to fix the bypass
2026-02-27: disclosed: Initial vulnerability disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.