CVE-2026-54281: NestJS authentication bypass in @nestjs/platform-fastify via trailing slash

CVE-2026-54281 · Severity: high · CVSS 4 · Published 2026-06-22

NestJS is a popular framework used to build web applications and APIs. A security flaw in its Fastify integration allows users to bypass security checks, such as login requirements, by simply adding a trailing slash to the end of a web address. This could allow unauthorized individuals to access sensitive data or perform actions they should not be allowed to do.

Technologies: NestJS Nest, NestJS Platform-Fastify, @nestjs/platform-fastify (npm). Vendors: NestJS, npm.

Quick answers

Is CVE-2026-54281 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54281 being exploited in the wild.
How severe is CVE-2026-54281?
High severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
NestJS Nest < 11.1.24; NestJS Platform-Fastify <= 11.1.23; @nestjs/platform-fastify (npm) <= 11.1.23, SEMVER:introduced=0,fixed=11.1.24.
Is there a fix for CVE-2026-54281?
Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54281 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54281?
Check whether you run NestJS Nest, NestJS Platform-Fastify or @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nestjs/platform-fastify (npm): upgrade to 11.1.24 or later
    npm install @nestjs/platform-fastify@11.1.24

Technical details

An authentication bypass vulnerability exists in the @nestjs/platform-fastify package when using the Fastify adapter. The issue occurs when middleware is registered via the MiddlewareConsumer.forRoutes() API; the middleware fails to execute if a trailing slash (/) is appended to the request URL, even in default configurations. This allows an attacker to bypass security logic, such as authentication or authorization guards implemented as middleware, for standard CRUD routes. The root cause is an inconsistency in how the Fastify adapter matches routes with trailing slashes against registered middleware. The vulnerability is resolved in version 11.1.24.

Affected products

  • nestjs nest < 11.1.24
  • nestjs @nestjs/platform-fastify <= 11.1.23

Identifiers

  • CVE-2026-54281
  • GHSA-6v32-fjc9-9qf6

Timeline

  • 2026-06-08: advisory: GitHub security advisory published
  • 2026-06-22: disclosed: NVD publication date
  • 2026-06-22: patched: Fix released in version 11.1.24

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.