CVE-2026-33011: Nest Fastify HEAD Request Middleware Bypass Vulnerability

Background

The @nestjs/platform-fastify package is a part of the NestJS framework, which is designed for building efficient and scalable server-side applications using Node.js. This package provides an integration layer for Fastify, a fast and low-overhead web framework. It allows developers to leverage Fastify's performance benefits while utilizing NestJS's powerful features. However, a vulnerability has been identified that allows GET middleware to be bypassed when handling HEAD requests, potentially leading to unintended behavior in applications.

Vulnerability Detail

The vulnerability arises from the way Fastify handles HEAD requests. When a HEAD request is made, Fastify automatically redirects it to the corresponding GET handler if it exists. This redirection causes middleware to be completely skipped, meaning that any security checks or processing that would normally occur in the middleware are not executed. Additionally, the HTTP response for a HEAD request will not include a body, as it is truncated during the redirection. This can lead to security implications, as the actual handler will still be executed without the expected middleware protections in place.

npm install @nestjs/platform-fastify@11.1.16

Workaround

As a temporary workaround, you can implement custom middleware that checks the request method and explicitly handles HEAD requests differently, ensuring that the necessary security checks are performed. For example:

app.use((req, res, next) => {
  if (req.method === 'HEAD') {
    // Perform necessary checks or processing
  }

next();

});

Conclusion

In summary, the CVE-2026-33011 vulnerability in the @nestjs/platform-fastify package allows for a bypass of GET middleware when handling HEAD requests. It is crucial to update to the patched version 11.1.16 to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until the update is applied.

See every vulnerability recorded for @nestjs/platform-fastify →

FAQ