NestJS platform-fastify path-scoped middleware bypass via absolute-form targets

Severity: high · CVSS 7.4 · Published 2026-09-30

NestJS's Fastify adapter uses middleware to enforce authentication, authorization, rate limiting, and logging on specific routes. An attacker sending HTTP requests with absolute-form targets (a valid HTTP syntax) can bypass these path-scoped middleware checks and reach protected handlers directly. This allows authentication and authorization controls to be skipped, potentially exposing sensitive data or enabling unauthorized actions.

Technologies: NestJS @Nestjs/Platform-Fastify. Vendors: NestJS.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.4, published 30 September 2026.
Which products and versions are affected?
NestJS @Nestjs/Platform-Fastify >=12.0.0 <12.0.2 and <11.2.4.
Is there a fix for This vulnerability?
A patch was published on 2026-09-30: Fixed in 12.0.2 and 11.2.4; upgrade to 12.0.3 or 11.2.5 recommended Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run NestJS @Nestjs/Platform-Fastify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability arises because Fastify's router resolves absolute-form request targets to paths before route matching, but the middleware matching logic in both the bundled @fastify/middie fork and FastifyAdapter's own route check operate against the raw request URL without absolute-form resolution. Additionally, deprecated top-level router options were not propagated to the middleware engine, causing path normalization mismatches. An unauthenticated network attacker can craft requests using absolute-form syntax (e.g., "GET http://host/path HTTP/1.1") to bypass middleware and access protected handlers.

Affected products

  • NestJS @nestjs/platform-fastify >=12.0.0 <12.0.2 and <11.2.4

Timeline

  • 2026-09-30: disclosed
  • 2026-09-30: patched: Fixed in 12.0.2 and 11.2.4; upgrade to 12.0.3 or 11.2.5 recommended

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.