Nest: Middleware Bypass on Fastify via Trailing Slash

高 8.7CVE-2026-54281 · GHSA-6v32-fjc9-9qf6 · 22/06/2026 公開 · 25/10/2026 更新

要点

CVE-2026-54281 は @nestjs/platform-fastify に影響する深刻度「高」 (CVSS 8.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.50%（全脆弱性の 42.7% より高い）。
対処：11.1.24 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
@nestjs/platform-fastify npm	`< 11.1.24`	`11.1.24`

概要

Impact

An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.

This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.

Patches

Fixed in @nestjs/[email protected]

References

Kudos goes to @a-tt-om

NVD の説明

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.