PT-2025-53755 · Unknown+2 · @Nestjs/Platform-Fastify+2

Kamilmysliwiec · Published 2025-12-29 · Updated 2026-02-20 · CVE-2025-69211

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nest versions prior to 11.1.11

Description Nest is a framework used for building scalable Node.js server-side applications. A flaw exists where the Fastify URL encoding middleware can be bypassed. This impacts applications utilizing @nestjs/platform-fastify and relying on NestMiddleware (through MiddlewareConsumer) or app.use() for security measures applied to specific routes using string paths or controllers, such as .forRoutes('admin'). Successful exploitation could allow unauthenticated access to protected routes, grant access to restricted administrative endpoints to unauthorized users, or bypass middleware responsible for sanitization or validation.

Recommendations Update to Nest version 11.1.11 or later.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2025-69211

GHSA-8WPR-639P-CCRJ

Affected Products

@Nestjs/Platform-Fastify

Fastify

Nest

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69211.json · Exploit
• https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj · Vendor Advisory
• https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-69211 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69211 · Vendor Advisory
• https://twitter.com/SystemTek_UK/status/2005730976987529551 · Twitter Post
• https://t.me/cveNotify/152616 · Telegram Post
• https://twitter.com/CVEnew/status/2005682616238845959 · Twitter Post
• https://t.me/CVEtracker/40842 · Telegram Post