# CVE-2026-54281: NestJS authentication bypass in @nestjs/platform-fastify via trailing slash

Source: https://junglewise.ai/threats/cve-2026-54281-nestjs-authentication-bypass-in-nestjs-platform-fastify-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-54281 · Severity: high · CVSS 4 · Published 2026-06-22

NestJS is a popular framework used to build web applications and APIs. A security flaw in its Fastify integration allows users to bypass security checks, such as login requirements, by simply adding a trailing slash to the end of a web address. This could allow unauthorized individuals to access sensitive data or perform actions they should not be allowed to do.

Technologies: [NestJS Nest](https://junglewise.ai/threats/technologies/nest), [NestJS Platform-Fastify](https://junglewise.ai/threats/technologies/platform-fastify), [@nestjs/platform-fastify (npm)](https://junglewise.ai/threats/technologies/nestjs-platform-fastify). Vendors: [NestJS](https://junglewise.ai/threats/vendors/nestjs), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54281 being exploited in the wild.

**How severe is CVE-2026-54281?** High severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** NestJS Nest < 11.1.24; NestJS Platform-Fastify <= 11.1.23; @nestjs/platform-fastify (npm) <= 11.1.23, SEMVER:introduced=0,fixed=11.1.24.

**Is there a fix for CVE-2026-54281?** Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54281 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54281?** Check whether you run NestJS Nest, NestJS Platform-Fastify or @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nestjs/platform-fastify (npm): upgrade to 11.1.24 or later

  ```sh
  npm install @nestjs/platform-fastify@11.1.24
  ```


## Technical details

An authentication bypass vulnerability exists in the @nestjs/platform-fastify package when using the Fastify adapter. The issue occurs when middleware is registered via the MiddlewareConsumer.forRoutes() API; the middleware fails to execute if a trailing slash (/) is appended to the request URL, even in default configurations. This allows an attacker to bypass security logic, such as authentication or authorization guards implemented as middleware, for standard CRUD routes. The root cause is an inconsistency in how the Fastify adapter matches routes with trailing slashes against registered middleware. The vulnerability is resolved in version 11.1.24.

## Affected products

- nestjs nest < 11.1.24
- nestjs @nestjs/platform-fastify <= 11.1.23

## Identifiers

- CVE-2026-54281
- GHSA-6v32-fjc9-9qf6

## Timeline

- 2026-06-08: advisory: GitHub security advisory published
- 2026-06-22: disclosed: NVD publication date
- 2026-06-22: patched: Fix released in version 11.1.24

## References

- [https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6](https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6)

## Related threats

- [NestJS denial of service via deeply nested microservice message pattern](https://junglewise.ai/threats/cve-2026-102281-nest-is-a-framework-for-building-scalable-node-js-server-side)
- [Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)](https://junglewise.ai/threats/cve-2026-40879-nest-affected-by-dos-via-recursive-handledata-in-jsonsocket-tcp)
- [@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')](https://junglewise.ai/threats/cve-2026-35515-nestjs-core-improperly-neutralizes-special-elements-in-output)
- [NestJS platform-fastify HEAD request middleware bypass](https://junglewise.ai/threats/cve-2026-33011-nestjs-platform-fastify-head-request-middleware-bypass)
- [NestJS platform-fastify authentication bypass via URL normalization](https://junglewise.ai/threats/nestjs-platform-fastify-authentication-bypass-via-url-normalization-7f9dc4ea)