Skip to content

⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY]#3038

Open
renovate[bot] wants to merge 1 commit intodevelopmentfrom
renovate/npm-nestjs-platform-fastify-vulnerability
Open

⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY]#3038
renovate[bot] wants to merge 1 commit intodevelopmentfrom
renovate/npm-nestjs-platform-fastify-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Dec 30, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@nestjs/platform-fastify (source) 11.1.3 → 11.1.14 age confidence

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

CVE-2025-69211 / GHSA-8wpr-639p-ccrj

More information

Details

A NestJS application is vulnerable if it meets all of the following criteria:

  1. Platform: Uses @nestjs/platform-fastify.
  2. Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
  3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')).
    Example Vulnerable Config:
// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // Security check
      .forRoutes('admin');   // Vulnerable: Path-based restriction
  }
}

Attack Vector:

  • Target Route: /admin
  • Middleware Path: admin
  • Attack Request: GET /%61dmin
  • Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.

Consequences:

  • Authentication Bypass: Unauthenticated users can access protected routes.
  • Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
  • Input Validation Bypass: Middleware performing sanitization or validation can be skipped.
Patches

Patched in @nestjs/platform-fastify@11.1.11

Resources

Credit goes to Hacktron AI for reporting this issue.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nest has a Fastify URL Encoding Middleware Bypass

CVE-2026-2293 / GHSA-r4wm-x892-vjmx

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options (e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.

The bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.

Nest passes Fastify routerOptions (such as ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.

But middleware execution is decided by a separate regex check over req.originalUrl in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.

If that regex does not match, Nest does next() and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.

This is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.

Patches

Fixed in @nestjs/platform-fastify@11.1.14

References

Credit goes to Fluidattacks (Cristian Vargas) https://fluidattacks.com/advisories/neton

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nestjs/nest (@​nestjs/platform-fastify)

v11.1.14

Compare Source

v11.1.14 (2026-02-17)

Bug fixes
Enhancements
Committers: 5

v11.1.13

Compare Source

v11.1.13 (2026-02-03)

Bug fixes
  • common
Enhancements
Dependencies
Committers: 6

v11.1.12

Compare Source

v11.1.12 (2026-01-15)

Bug fixes
Dependencies
Committers: 3

v11.1.11

Compare Source

v11.1.11 (2025-12-29)

Bug fixes
Dependencies
Committers: 3

v11.1.10

Compare Source

v11.1.10 (2025-12-22)

Bug fixes
Enhancements
Dependencies
Committers: 11

v11.1.9

Compare Source

v11.1.9 (2025-11-14)

Bug fixes
Enhancements
Dependencies
Committers: 4

v11.1.8

Compare Source

v11.1.8 (2025-10-27)

Bug fixes
Committers: 2

v11.1.7

Compare Source

v11.1.7 (2025-10-21)

Bug fixes
Enhancements
Dependencies
Committers: 9

v11.1.6

Compare Source

v11.1.6 (2025-08-07)
Bug fixes
Dependencies
Committers: 6

v11.1.5

Compare Source

v11.1.5 (2025-07-18)

Dependencies

v11.1.4

Compare Source

v11.1.4 (2025-07-16)

Bug fixes
Enhancements
Dependencies
Committers: 11

Configuration

📅 Schedule: (in timezone Europe/Zurich)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Dec 30, 2025
@renovate renovate Bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch 2 times, most recently from 336a467 to 36aef5d Compare January 23, 2026 19:32
@renovate renovate Bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch from 36aef5d to 72b797b Compare February 2, 2026 19:13
@renovate renovate Bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch from 72b797b to 945fe40 Compare February 12, 2026 11:40
@renovate renovate Bot changed the title ⬆️ Update dependency @nestjs/platform-fastify to v11.1.11 [SECURITY] ⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY] Mar 3, 2026
@renovate renovate Bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch from 945fe40 to cb0dce8 Compare March 3, 2026 17:34
@renovate renovate Bot changed the title ⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY] ⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/npm-nestjs-platform-fastify-vulnerability branch March 27, 2026 01:38
@renovate renovate Bot changed the title ⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY] - autoclosed ⬆️ Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch 2 times, most recently from cb0dce8 to 13bfc5e Compare March 30, 2026 18:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants