GHSA-8wpr-639p-ccrj
NoneCVSS
—
EPSS
—
Published
Dec 30, 2025
CISA due date
—
The record
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @nestjs/platform-fastify | 0 | 11.1.11 |
Related vulnerabilities
- CVE-2025-69211 Nest is a framework for building scalable Node.js server-side applications. Same vulnerability
- CVE-2026-54281 Nest is a framework for building scalable Node.js server-side applications. Also affects @nestjs/platform-fastify
- GHSA-6v32-fjc9-9qf6 Nest: Middleware Bypass on Fastify via Trailing Slash Also affects @nestjs/platform-fastify
- CVE-2026-33011 Nest is a framework for building scalable Node.js server-side applications. Also affects @nestjs/platform-fastify
- GHSA-wf42-42fg-fg84 Nest Fastify HEAD Request Middleware Bypass Also affects @nestjs/platform-fastify
- GHSA-r4wm-x892-vjmx Nest has a Fastify URL Encoding Middleware Bypass Also affects @nestjs/platform-fastify
- GHSA-7q64-3rg2-h9pf Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass Also affects @nestjs/platform-fastify
- CVE-2026-2293 A NestJS application using @nestjs/platform-fastify can allow bypass of… Also affects @nestjs/platform-fastify