CVE-2026-2293
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Feb 27, 2026
CISA due date
—
The record
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @nestjs/platform-fastify | 0 | 11.1.14 |
Related vulnerabilities
- GHSA-r4wm-x892-vjmx Nest has a Fastify URL Encoding Middleware Bypass Same vulnerability
- CVE-2026-54281 Nest is a framework for building scalable Node.js server-side applications. Also affects @nestjs/platform-fastify
- GHSA-6v32-fjc9-9qf6 Nest: Middleware Bypass on Fastify via Trailing Slash Also affects @nestjs/platform-fastify
- CVE-2026-33011 Nest is a framework for building scalable Node.js server-side applications. Also affects @nestjs/platform-fastify
- GHSA-wf42-42fg-fg84 Nest Fastify HEAD Request Middleware Bypass Also affects @nestjs/platform-fastify
- GHSA-7q64-3rg2-h9pf Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass Also affects @nestjs/platform-fastify
- GHSA-8wpr-639p-ccrj Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) Also affects @nestjs/platform-fastify
- CVE-2025-69211 Nest is a framework for building scalable Node.js server-side applications. Also affects @nestjs/platform-fastify