Executive brief
NestJS is a popular Node.js framework for building server applications, and @nestjs/platform-fastify is an adapter that integrates the Fastify web server. When Fastify's path-normalization options are enabled, an attacker can bypass authentication and authorization middleware by manipulating URL paths, allowing unauthorized access to protected resources or functionality.
Technical details
The vulnerability is an authorization bypass (CWE-863) in @nestjs/platform-fastify that occurs when Fastify's path-normalization settings are active. By crafting specially normalized URLs, an attacker can circumvent authentication/authorization middleware checks without requiring credentials. The attack is network-accessible with no user interaction needed. The vulnerability affects @nestjs/platform-fastify versions before 11.1.14; a fix is available in version 11.1.14 and later.
Affected products
- NestJS @nestjs/platform-fastify before 11.1.14
Timeline
- 2026-02-27: disclosed
- 2026-02-27: patched: patch released as version 11.1.14
- 2026-03-02: other: advisory withdrawn as duplicate of GHSA-r4wm-x892-vjmx