Executive brief
NestJS is a popular Node.js framework for building server applications. The Fastify adapter (platform-fastify) contains a security flaw where HTTP HEAD requests bypass middleware security checks while still executing application handlers. This allows attackers to circumvent authentication, authorization, logging, and other protective middleware layers that guard sensitive operations.
Technical details
The vulnerability is a middleware bypass flaw (CWE-670) in @nestjs/platform-fastify where Fastify automatically redirects HEAD requests to corresponding GET handlers. When this occurs, NestJS middleware attached to GET routes is skipped entirely, while the underlying route handler still executes. The attack vector is network-based with no authentication or user interaction required. An attacker can send HEAD requests to GET endpoints to bypass security middleware (authentication, authorization, rate limiting, logging) while still triggering the handler logic. The vulnerability affects all versions up to 11.1.15; it is fixed in 11.1.16 and later.
Affected products
- NestJS platform-fastify < 11.1.16
Timeline
- 2026-03-16: disclosed
- 2026-03-17: advisory
- 2026-03-17: patched: Fixed in @nestjs/platform-fastify 11.1.16