# NestJS platform-fastify path-scoped middleware bypass via absolute-form targets

Source: https://junglewise.ai/threats/nestjs-platform-fastify-path-scoped-middleware-bypass-via-absolute-form-738dbc19  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.4 · Published 2026-09-30

NestJS's Fastify adapter uses middleware to enforce authentication, authorization, rate limiting, and logging on specific routes. An attacker sending HTTP requests with absolute-form targets (a valid HTTP syntax) can bypass these path-scoped middleware checks and reach protected handlers directly. This allows authentication and authorization controls to be skipped, potentially exposing sensitive data or enabling unauthorized actions.

Technologies: [NestJS @Nestjs/Platform-Fastify](https://junglewise.ai/threats/technologies/platform-fastify). Vendors: [NestJS](https://junglewise.ai/threats/vendors/nestjs).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.4, published 30 September 2026.

**Which products and versions are affected?** NestJS @Nestjs/Platform-Fastify >=12.0.0 <12.0.2 and <11.2.4.

**Is there a fix for This vulnerability?** A patch was published on 2026-09-30: Fixed in 12.0.2 and 11.2.4; upgrade to 12.0.3 or 11.2.5 recommended Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run NestJS @Nestjs/Platform-Fastify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability arises because Fastify's router resolves absolute-form request targets to paths before route matching, but the middleware matching logic in both the bundled @fastify/middie fork and FastifyAdapter's own route check operate against the raw request URL without absolute-form resolution. Additionally, deprecated top-level router options were not propagated to the middleware engine, causing path normalization mismatches. An unauthenticated network attacker can craft requests using absolute-form syntax (e.g., "GET http://host/path HTTP/1.1") to bypass middleware and access protected handlers.

## Affected products

- NestJS @nestjs/platform-fastify >=12.0.0 <12.0.2 and <11.2.4

## Timeline

- 2026-09-30: disclosed
- 2026-09-30: patched: Fixed in 12.0.2 and 11.2.4; upgrade to 12.0.3 or 11.2.5 recommended