Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 27 February 2026.

Which products and versions are affected?

@nestjs/platform-fastify (npm) SEMVER:introduced=0,fixed=11.1.14.

Is there a fix for This vulnerability?

Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

NestJS platform-fastify authentication bypass via URL normalization

Severity: medium · CVSS 4 · Published 2026-02-27

NestJS is a popular Node.js framework for building server applications, and @nestjs/platform-fastify is an adapter that integrates the Fastify web server. When Fastify's path-normalization options are enabled, an attacker can bypass authentication and authorization middleware by manipulating URL paths, allowing unauthorized access to protected resources or functionality.

Technologies: @nestjs/platform-fastify (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 27 February 2026.
Which products and versions are affected?: @nestjs/platform-fastify (npm) SEMVER:introduced=0,fixed=11.1.14.
Is there a fix for This vulnerability?: Yes. @nestjs/platform-fastify (npm): upgrade to 11.1.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @nestjs/platform-fastify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nestjs/platform-fastify (npm): upgrade to 11.1.14 or later
```
npm install @nestjs/platform-fastify@11.1.14
```

Technical details

The vulnerability is an authorization bypass (CWE-863) in @nestjs/platform-fastify that occurs when Fastify's path-normalization settings are active. By crafting specially normalized URLs, an attacker can circumvent authentication/authorization middleware checks without requiring credentials. The attack is network-accessible with no user interaction needed. The vulnerability affects @nestjs/platform-fastify versions before 11.1.14; a fix is available in version 11.1.14 and later.

Affected products

NestJS @nestjs/platform-fastify before 11.1.14

Timeline

2026-02-27: disclosed
2026-02-27: patched: patch released as version 11.1.14
2026-03-02: other: advisory withdrawn as duplicate of GHSA-r4wm-x892-vjmx

References

https://fluidattacks.com/advisories/neton

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.