NestJS @nestjs/platform-fastify Authentication and Authorization Middleware Bypass

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

• nest.js with the nestjs package: the normalized record identifies version 11.1.13 as affected.
• The vendor advisory identifies @nestjs/platform-fastify as affected in versions <= 11.1.13 and patched in 11.1.14.
• Red Hat CSAF lists Red Hat Developer Hub and Red Hat OpenShift Container Platform 4 as known not affected because the named products do not contain the vulnerable code.
• The available evidence does not establish the status of every other NestJS branch or downstream product beyond the products named above.

The flaw is in the @nestjs/platform-fastify adapter, where Fastify routing and NestJS middleware application interpret the request URL differently. The attacker-controlled input is the HTTP request path, specifically a path variant that Fastify normalizes but NestJS's middleware matcher does not match. NestJS passes Fastify routerOptions, including ignoreTrailingSlash, ignoreDuplicateSlashes, and useSemicolonDelimiter, to the router, while middleware execution uses a separate regular-expression check over req.originalUrl. When that expression does not match, NestJS calls next() and skips the middleware, while Fastify may normalize the path and still dispatch the request to the protected handler. The vendor advisory identifies the relevant logic in packages/platform-fastify/adapters/fastify-adapter.ts, including the router-option handling and middleware checks. Exploitation requires an application using the Fastify adapter, non-default path-normalization options, and route-scoped middleware protecting a handler; the exact routes and middleware wiring remain application-specific.

• The issue is remotely reachable through network requests to an affected NestJS application.
• The supplied record describes no prerequisite privileges and no user interaction; the deployment prerequisite is that Fastify path-normalization options are enabled.
• Exploit complexity is described as low, although the request must use a path variant that creates different interpretations for middleware matching and routing.
• The record marks public_exploit as true, and the CNA advisory presents evidence of a proof of concept for unauthorized bypass. This confirms public demonstration evidence, not exploitation in a particular environment.
• No named campaign, victim, or specific incident is identified in the evidence reviewed.

A request that has not passed authentication or authorization middleware may still reach a protected handler after Fastify normalizes its path. The confirmed technical outcome is an access-control bypass that may permit unauthorized operations within the affected application. Consequences for data integrity and access depend on the handlers, roles, and business actions protected by the middleware. The record does not provide enough evidence to conclude that all data can be read, that services can be disrupted, or that every deployment is affected.

• Weakens the authentication and authorization boundary for endpoints protected by route-scoped middleware.
• May allow unauthorized requests to perform data or state changes that the application intended to permit only after an authorization check.
• Can create access-control failures, unauthorized business operations, data-integrity concerns, and investigation requirements for requests that reached protected handlers without the expected middleware.
• The actual data and operations at risk depend on each handler, role model, and business workflow; the evidence does not show that every endpoint or deployment is exposed.

1. Upgrade @nestjs/platform-fastify to exactly 11.1.14, which the vendor advisory identifies as patched.
2. Update the lockfile and redeploy every service using the Fastify adapter, then verify the effective package version in the built artifact and runtime.
3. Review Fastify path-normalization options and route-scoped authentication or authorization middleware to identify deployments that meet the exploitation conditions.
4. If an immediate update is not possible, the consulted advisories do not document a vendor-confirmed temporary workaround. Reviewing whether non-default normalization options can be disabled and reducing exposure of related routes may reduce risk temporarily, but this should not be treated as a confirmed substitute for the patch.
5. Retest protected handlers after updating, including accepted URL representations, to confirm that middleware matching and router dispatch apply the same path interpretation.

• Inventory dependencies and lockfiles across all applications for @nestjs/platform-fastify, then verify the effective runtime version rather than relying only on declared dependency data.
• Inspect Fastify router configuration for ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter, and similar path-normalization options.
• Identify route-scoped authentication or authorization middleware and the protected handlers they are expected to guard.
• In an authorized test environment, compare access-control results for a canonical path and path variants that Fastify normalizes. This is a validation check, not proof that the absence of a failure establishes safety.
• If the application emits middleware and handler telemetry, correlate requests reaching protected handlers with the expected middleware events. Treat this as precautionary monitoring, not as a vendor-confirmed indicator.