CVE-2026-54281: @nestjs/platform-fastify Middleware Bypass via Trailing Slash
Summary
CVE-2026-54281: Nest: Middleware Bypass on Fastify via Trailing Slash. Affects @nestjs/platform-fastify versions < 11.1.24. Fixed in 11.1.24. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nestjs/platform-fastify package is a framework that allows developers to build server-side applications using the Fastify web framework within the NestJS ecosystem. It provides a robust set of features for building scalable and maintainable applications. However, a significant vulnerability has been identified that allows unauthenticated access to protected routes when a trailing slash is appended to the URL.
Vulnerability Detail
An authentication bypass vulnerability exists in the @nestjs/platform-fastify package, confirmed in version 11.1.24. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API, an unauthenticated client can bypass the middleware by appending a trailing slash to the request URL. This issue affects applications using standard CRUD route shapes, such as GET /resource and GET /resource/:id, when those routes are protected with MiddlewareConsumer.forRoutes() middleware. The vulnerability is classified under CWE-863, indicating improper authorization.
How To Fix
Minimum fixed version
11.1.24
This is the first release that contains the fix.
npm install @nestjs/platform-fastify@11.1.24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation in your middleware to check for trailing slashes and reject requests that do not meet your authentication criteria. For example, you could modify your middleware like this: function myMiddleware(req, res, next) { if (
req.url.endsWith('/')) { return res.status(403).send('Access denied');
} next(); }
Conclusion
The @nestjs/platform-fastify package has a critical vulnerability that allows unauthenticated access to protected routes through a simple URL manipulation. It is essential to update to the patched version 11.1.24 or implement a workaround to secure your application.
See every vulnerability recorded for @nestjs/platform-fastify →
FAQ
The vulnerability allows unauthenticated users to bypass middleware protections, potentially exposing sensitive data or functionality.
Versions up to and including 11.1.23 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
Implement a temporary workaround by adding validation in your middleware to handle trailing slashes appropriately.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nestjs/platform-fastify.
