In short
- CVE-2025-69211 is a HIGH (CVSS 7.4) vulnerability affecting nest (nestjs), @nestjs/platform-fastify.
- Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 32.2% of all vulnerabilities.
- Fix: update to 11.1.11 or later.
Description
A NestJS application is vulnerable if it meets all of the following criteria:
- Platform: Uses
@nestjs/platform-fastify.
- Security Mechanism: Relies on
NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
- Routing: Applies middleware to specific routes using string paths or controllers (e.g.,
.forRoutes('admin')).
Example Vulnerable Config:
// app.module.ts
export class AppModule implements NestModule {
configure(consumer: MiddlewareConsumer) {
consumer
.apply(AuthMiddleware) // Security check
.forRoutes('admin'); // Vulnerable: Path-based restriction
}
}
Attack Vector:
- Target Route:
/admin
- Middleware Path:
admin
- Attack Request:
GET /%61dmin
- Result: Middleware is skipped (no match on
%61dmin), but controller for /admin is executed.
Consequences:
- Authentication Bypass: Unauthenticated users can access protected routes.
- Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
- Input Validation Bypass: Middleware performing sanitization or validation can be skipped.
Patches
Patched in @nestjs/[email protected]
Resources
Credit goes to Hacktron AI for reporting this issue.
NVD description
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/[email protected]`.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free