{"id":"EUVD-2025-205611","enisaUuid":"0196dbb3-9179-3b3b-bb22-c3b9ebc32f39","description":"Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes(\u0027admin\u0027)`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.","datePublished":"Dec 29, 2025, 4:01:22 PM","dateUpdated":"Dec 29, 2025, 4:50:02 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":"https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj\nhttps://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771\n","aliases":"CVE-2025-69211\nGHSA-8wpr-639p-ccrj\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"ffd5adea-09ad-3452-b776-da3c7b2e785f","product":{"name":"nest","vendor":{"name":"nestjs"}},"product_version":"\u003c 11.1.11"}],"enisaIdVendor":[{"id":"9f0597b9-90ba-3e65-9266-b3b23280838b","vendor":{"name":"nestjs"}}],"enisaIdVulnerability":[{"id":"9311be00-106f-3472-be7c-67e74df585dd","vulnerability":{"id":"GHSA-8wpr-639p-ccrj","description":"Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)","datePublished":"Dec 30, 2025, 3:32:44 PM","dateUpdated":"Dec 30, 2025, 3:32:44 PM","baseScore":0.0,"references":"https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-69211\nhttps://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771\nhttps://github.com/nestjs/nest\n","enisa_id":"EUVD-2025-205611\n","aliases":"GHSA-8wpr-639p-ccrj\nCVE-2025-69211\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:45:06 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"af59466d-3d8c-3583-a24a-1ad859f58bcd","vulnerability":{"id":"CVE-2025-69211","description":"Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes(\u0027admin\u0027)`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.","datePublished":"Dec 29, 2025, 4:01:22 PM","dateUpdated":"Dec 29, 2025, 4:50:02 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","references":"https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj\nhttps://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771\n","enisa_id":"EUVD-2025-205611\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 10, 2026, 7:34:18 AM","vulnerabilityProduct":[{"id":"28cc3da8-cda2-3dae-ac08-2df4a1de4e84","product":{"name":"nest","vendor":{"name":"nestjs"}},"product_version":"\u003c 11.1.11"}],"vulnerabilityVendor":[{"id":"20858fb1-88dd-3192-848b-4201a1dbc9c2","vendor":{"name":"nestjs"}}]}}],"enisaIdAdvisory":[]}