{"id":"EUVD-2026-38398","enisaUuid":"38d63818-947c-3fa7-8f42-de5b72ae06fa","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS\u0027s MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.","datePublished":"Jun 22, 2026, 8:48:45 PM","dateUpdated":"Jun 24, 2026, 3:56:27 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6\n","aliases":"CVE-2026-54281\nGHSA-6v32-fjc9-9qf6\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"a983be3e-d05c-3013-8a14-c58db71a922d","product":{"name":"nest","vendor":{"name":"nestjs"}},"product_version":"\u003c 11.1.24"}],"enisaIdVendor":[{"id":"977e87ed-6a3a-3913-add1-af30e1dd49b5","vendor":{"name":"nestjs"}}],"enisaIdVulnerability":[{"id":"396d03e9-80bd-3583-aa8b-53f35c085ae1","vulnerability":{"id":"GHSA-6v32-fjc9-9qf6","description":"Nest: Middleware Bypass on Fastify via Trailing Slash","datePublished":"Jun 15, 2026, 8:36:43 PM","dateUpdated":"Jul 18, 2026, 5:26:42 PM","baseScore":0.0,"references":"https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54281\nhttps://github.com/nestjs/nest\n","enisa_id":"EUVD-2026-38398\n","aliases":"GHSA-6v32-fjc9-9qf6\nCVE-2026-54281\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"efd94a13-041f-381f-b742-f55d4434d438","vulnerability":{"id":"CVE-2026-54281","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS\u0027s MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.","datePublished":"Jun 22, 2026, 8:48:45 PM","dateUpdated":"Jun 24, 2026, 3:56:27 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6\n","enisa_id":"EUVD-2026-38398\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Nov 5, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"db2a2dff-6403-37c0-b3de-6fbefd04942d","product":{"name":"nest","vendor":{"name":"nestjs"}},"product_version":"\u003c 11.1.24"}],"vulnerabilityVendor":[{"id":"89884aa0-5969-3f79-b505-86faeb1a1990","vendor":{"name":"nestjs"}}]}}],"enisaIdAdvisory":[]}