Fastify URL Encoding Middleware Bypass in @nestjs/platform-fastify
Summary
GHSA-7q64-3rg2-h9pf: Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass. Affects @nestjs/platform-fastify versions < 11.1.14. Fixed in 11.1.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nestjs/platform-fastify package is a NestJS adapter that enables the use of Fastify as the underlying HTTP server. NestJS is a progressive Node.js framework for building efficient and scalable server-side applications. The package provides a range of features, including middleware support, routing, and dependency injection. However, it has been identified that when Fastify path-normalization options are enabled, it can allow unauthorized access by bypassing authentication and authorization middleware.
Vulnerability Detail
The vulnerability arises from the way Fastify handles URL encoding and path normalization in conjunction with the @nestjs/platform-fastify package. When certain path-normalization options are enabled, it can lead to a situation where authentication and authorization checks are bypassed, allowing unauthorized users to access restricted resources. This can have serious implications for applications relying on this middleware for security, potentially exposing sensitive data or functionality to malicious actors.
How To Fix
Minimum fixed version
11.1.14
This is the first release that contains the fix.
npm install @nestjs/platform-fastify@11.1.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the Fastify path-normalization options in your application configuration. This may involve modifying your Fastify instance setup to ensure that the middleware does not allow for path normalization that could lead to bypassing security checks.
Conclusion
The vulnerability in the @nestjs/platform-fastify package highlights the importance of keeping dependencies up to date and being aware of how middleware configurations can impact application security. By following the recommended steps to update the package and considering workarounds, developers can protect their applications from potential exploitation.
See every vulnerability recorded for @nestjs/platform-fastify →
FAQ
The vulnerability allows for the bypass of authentication and authorization middleware in NestJS applications using Fastify, potentially exposing sensitive resources.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can alert you in real-time for any vulnerabilities, including this one.
If you cannot update the package right away, consider disabling Fastify's path-normalization options as a temporary workaround to mitigate the risk.
Yes, using Vulert's playground, you can check if your application is affected by this vulnerability without any signup, simply by uploading your package-lock.json.
If exploited, this vulnerability could allow unauthorized users to access restricted areas of your application, leading to data breaches or unauthorized actions.
Related vulnerabilities
Recent vulnerabilities recorded for @nestjs/platform-fastify.
