# CVE-2026-2293: NestJS auth bypass in @nestjs/platform-fastify

Source: https://junglewise.ai/threats/cve-2026-2293-nestjs-auth-bypass-in-nestjs-platform-fastify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2293 · Severity: critical · CVSS 9.8 · Published 2026-02-27

NestJS is a popular framework for building server-side web applications. A security flaw in its Fastify integration allows attackers to bypass security checks like login requirements or permission controls. This could lead to unauthorized access to sensitive data or administrative functions by simply manipulating the web address used to access the application.

Technologies: [NestJS Nest](https://junglewise.ai/threats/technologies/nest), [@nestjs/platform-fastify (npm)](https://junglewise.ai/threats/technologies/nestjs-platform-fastify). Vendors: [NestJS](https://junglewise.ai/threats/vendors/nestjs), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-2293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2293 being exploited in the wild.

**How severe is CVE-2026-2293?** Critical severity, with a CVSS score of 9.8, published 27 February 2026.

**Which products and versions are affected?** NestJS 11.1.13; @nestjs/platform-fastify (npm) SEMVER:introduced=0,fixed=11.1.14.

**Is there a fix for CVE-2026-2293?** Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2293 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2293?** Check whether you run NestJS Nest, NestJS or @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nestjs/platform-fastify (npm): upgrade to 11.1.14 or later

  ```sh
  npm install @nestjs/platform-fastify@11.1.14
  ```


## Technical details

An authentication and authorization bypass vulnerability exists in NestJS when using the @nestjs/platform-fastify adapter. The issue stems from a discrepancy in how paths are handled between NestJS middleware and the underlying Fastify engine when path-normalization options are enabled (CWE-551). Specifically, an attacker can craft a URL that bypasses security guards or middleware but is still routed to a protected controller by the underlying engine. This allows unauthenticated remote attackers to access restricted endpoints. The vulnerability is addressed in NestJS version 11.1.14.

## Affected products

- nestjs nest.js 11.1.13

## Identifiers

- CVE-2026-2293
- GHSA-r4wm-x892-vjmx

## Timeline

- 2026-02-17: patched: Version 11.1.14 released to fix the bypass
- 2026-02-27: disclosed: Initial vulnerability disclosure and CVE assignment

## References

- [https://registry.npmjs.org/](https://registry.npmjs.org/)
- [https://fluidattacks.com/advisories/neton](https://fluidattacks.com/advisories/neton)
- [https://github.com/nestjs/nest/](https://github.com/nestjs/nest/)
- [https://github.com/nestjs/nest/releases/tag/v11.1.14](https://github.com/nestjs/nest/releases/tag/v11.1.14)
- [https://access.redhat.com/security/cve/CVE-2026-2293](https://access.redhat.com/security/cve/CVE-2026-2293)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2443367](https://bugzilla.redhat.com/show_bug.cgi?id=2443367)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2293.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2293.json)

## Related threats

- [NestJS denial of service via deeply nested microservice message pattern](https://junglewise.ai/threats/cve-2026-102281-nest-is-a-framework-for-building-scalable-node-js-server-side)
- [NestJS authentication bypass in @nestjs/platform-fastify via trailing slash](https://junglewise.ai/threats/cve-2026-54281-nestjs-authentication-bypass-in-nestjs-platform-fastify-via)
- [Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)](https://junglewise.ai/threats/cve-2026-40879-nest-affected-by-dos-via-recursive-handledata-in-jsonsocket-tcp)
- [@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')](https://junglewise.ai/threats/cve-2026-35515-nestjs-core-improperly-neutralizes-special-elements-in-output)
- [NestJS platform-fastify HEAD request middleware bypass](https://junglewise.ai/threats/cve-2026-33011-nestjs-platform-fastify-head-request-middleware-bypass)