Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: middleware will be completely skipped, the HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler), and the actual handler will still be executed. This issue is fixed in version 11.1.16.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 2 | Disclosure1Patch1 |
| 2026-03-24 | 1 | Disclosure1 |
🟠 NestJS, Middleware Bypass via HEAD Request Redirection, #CVE-2026-33011 (Medium) https://dailycve.com/nestjs-middleware-bypass-via-head-request-redirection-cve-2026-33011-medium/
Post summary
A brief announcement of CVE-2026-33011, a medium‑severity NestJS middleware bypass caused by HEAD request redirection, with a link to a daily CVE report.
CVE-2026-33011 Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET mid… https://www.cve.org/CVERecord?id=CVE-2026-33011
Post summary
The post briefly announces CVE‑2026‑33011, noting affected NestJS versions but providing no PoC, exploit, mitigation, or technical details.
🚨 CVE-2026-33011: NestJS apps using @nestjs/platform-fastify let HEAD calls bypass GET middleware, running handlers without checks. Upgrade to 11.1.16+ to stay secure. More details ➡️ https://volerion.com/vulnerabilities/CVE-2026-33011 #NestJS #NodeJS #AppSec
Post summary
The advisory highlights that HEAD requests in NestJS apps using @nestjs/platform-fastify bypass GET middleware, and recommends upgrading to v11.1.16+ with additional details available at the linked page.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nestjs | nest | - | node.js | - |