CVE-2025-69211: @nestjs/platform-fastify Fastify URL Encoding Middleware Bypass Vulnerability
Summary
CVE-2025-69211: Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU). Affects @nestjs/platform-fastify versions < 11.1.11. Fixed in 11.1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nestjs/platform-fastify package is a part of the NestJS framework, which is designed for building efficient and scalable server-side applications. It provides a Fastify-based platform for NestJS applications, enabling high performance and low overhead. However, this package is vulnerable to a specific issue related to URL encoding, which can lead to significant security risks if not addressed.
Vulnerability Detail
The vulnerability arises from a Time-of-Check to Time-of-Use (TOCTOU) issue in the middleware configuration. If a NestJS application uses @nestjs/platform-fastify and applies security middleware to specific routes based on string paths, it can be bypassed through URL encoding. For instance, an attacker can access the protected '/admin' route by sending a request to '/%61dmin', which circumvents the middleware checks. This can lead to unauthorized access to sensitive routes, allowing unauthenticated users to perform actions that should be restricted, such as accessing administrative endpoints or bypassing input validation.
How To Fix
Minimum fixed version
11.1.11
This is the first release that contains the fix.
npm install @nestjs/platform-fastify@11.1.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using path-based restrictions for middleware. Instead, consider applying middleware globally or using more robust methods for route protection that do not rely solely on string matching.
Conclusion
The CVE-2025-69211 vulnerability in the @nestjs/platform-fastify package poses significant security risks due to its URL encoding middleware bypass. It is crucial for developers to update to the patched version and consider alternative middleware application strategies to safeguard their applications.
See every vulnerability recorded for @nestjs/platform-fastify →
FAQ
The vulnerability is a TOCTOU issue that allows attackers to bypass security middleware by using URL encoding.
If your application uses @nestjs/platform-fastify and applies middleware to specific routes based on string paths, it may be vulnerable. You can check your package-lock.json with Vulert to see if you are affected.
The consequences include unauthorized access to protected routes, potential data exposure, and the ability to perform actions without proper authentication or authorization.
Yes, the vulnerability has been patched in version 11.1.11 of @nestjs/platform-fastify. Updating to this version will resolve the issue.
You can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can also check your application against known vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nestjs/platform-fastify.
