CVE-2026-2293: NestJS @nestjs/platform-fastify URL Encoding Middleware Bypass Vulnerability
Summary
CVE-2026-2293: Nest has a Fastify URL Encoding Middleware Bypass. Affects @nestjs/platform-fastify versions < 11.1.14. Fixed in 11.1.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NestJS is a progressive Node.js framework for building efficient and scalable server-side applications. It leverages TypeScript and is heavily inspired by Angular, providing a modular architecture and a rich ecosystem. The @nestjs/platform-fastify package allows NestJS applications to utilize the Fastify web framework, known for its high performance and low overhead. However, a vulnerability has been identified in this package that can lead to security bypasses in middleware checks.
Vulnerability Detail
The vulnerability arises from a mismatch in path canonicalization between middleware matching and route matching within the NestJS Fastify adapter. When certain Fastify path-normalization options are enabled, such as ignoreTrailingSlash, ignoreDuplicateSlashes, and useSemicolonDelimiter, it can allow requests to bypass middleware checks. This means that variant paths may still reach protected handlers without undergoing necessary security checks, leading to potential unauthorized access. The issue is rooted in a fail-open design where security checks and request dispatching utilize different URL interpretations.
How To Fix
Minimum fixed version
11.1.14
This is the first release that contains the fix.
npm install @nestjs/platform-fastify@11.1.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the Fastify path-normalization options that are causing the issue. For example, ensure that ignoreTrailingSlash, ignoreDuplicateSlashes, and useSemicolonDelimiter are set to false in your Fastify router options. This can be done in your NestJS application setup as follows:
const app = await
NestFactory.
create(AppModule, { logger: true });
app.useGlobalPipes(new ValidationPipe());
app.enableShutdownHooks(); await
app.listen(3000);
Conclusion
The CVE-2026-2293 vulnerability in the @nestjs/platform-fastify package poses a significant risk by allowing middleware bypasses due to inconsistent URL interpretations. It is crucial for developers using this package to update to the patched version to ensure the security of their applications.
See every vulnerability recorded for @nestjs/platform-fastify →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
Any NestJS application using the @nestjs/platform-fastify package with specific Fastify path-normalization options enabled is affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help identify if your application is affected by this vulnerability.
Yes, you can temporarily disable the Fastify path-normalization options that are causing the issue as a workaround until you can update the package.
More information can be found in the advisory published by Fluidattacks and on the GitHub advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nestjs/platform-fastify.
