PT-2026-49595 · Npm · @Nestjs/Platform-Fastify

Published 2026-06-15 · Updated 2026-06-16 · CVE-2026-54281

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @nestjs/platform-fastify versions prior to 11.1.24

Description An authentication bypass exists in the Fastify adapter when middleware is registered through the MiddlewareConsumer.forRoutes() API. An unauthenticated client can bypass registered middleware, such as authentication guards, rate limiting, or logging, by appending a trailing slash (/) to the request URL. This issue occurs with the default Fastify adapter configuration and specifically affects applications using standard CRUD route shapes, such as 'GET /resource' and 'GET /resource/:id'.

Recommendations Update to version 11.1.24.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-54281

GHSA-6V32-FJC9-9QF6

Affected Products

@Nestjs/Platform-Fastify

References · 4

• https://osv.dev/vulnerability/GHSA-6v32-fjc9-9qf6 · Vendor Advisory
• https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6 · Note
• https://github.com/nestjs/nest · Note
• https://twitter.com/UpwindMDR/status/2066785770799505679 · Twitter Post