CVE-2026-54281Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR138d
Patch
🚨 High - NestJS Fastify Middleware Bypass (CVE-2026-54281) A trailing slash on any request URL silently bypasses middleware guards in the @nestjs/platform-fastify adapter. Routes protected by auth middleware, rate limiting, or logging are fully exposed on default-configured apps - no credentials or special setup required. Affects all NestJS apps using the Fastify adapter with MiddlewareConsumer.forRoutes() (CVSS 8.7). 👉 Affected: @nestjs/platform-fastify ≤ 11.1.23 | Upgrade to 11.1.24
Post summary
High‑severity vulnerability in NestJS Fastify middleware bypass disclosed, with a clear patch available (upgrade to 11.1.24).
0000074
217 followersView on X

Explore more

Back to dashboard