{"id":"GHSA-6v32-fjc9-9qf6","revision":"f31aed4c643d4897914411e0a318c134","records":[{"revision":"f31aed4c643d4897914411e0a318c134","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6v32-fjc9-9qf6","aliases":["CVE-2026-54281"],"title":"Nest: Middleware Bypass on Fastify via Trailing Slash","description":"### Impact\n\nAn authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS's `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL.\n\nThis bypass works on the **default Fastify adapter configuration** — no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware.\n\n### Patches\n\nFixed in `@nestjs/platform-fastify@11.1.24`\n\n### References\n\nKudos goes to @a-tt-om","state":0,"publishedAt":"2026-06-15T20:36:43+00:00","modifiedAt":"2026-07-18T17:30:30.681313+00:00","affected":[{"ecosystem":"npm","name":"@nestjs/platform-fastify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"11.1.24"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6","https://nvd.nist.gov/vuln/detail/CVE-2026-54281","https://github.com/nestjs/nest"],"sourceUrl":"https://github.com/advisories/GHSA-6v32-fjc9-9qf6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6v32-fjc9-9qf6","identifiers":["GHSA-6v32-fjc9-9qf6","CVE-2026-54281"]},"retained":false,"historicalAffected":[]}],"coverage":[]}