CVE-2026-54281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.

CVSS

No CVSS.

References

Link	Resource
https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nest es un framework para construir aplicaciones escalables de servidor Node.js. Antes de la versión 11.1.24, existe una vulnerabilidad de omisión de autenticación en @nestjs/platform-fastify. Cuando el middleware se registra a través de la API MiddlewareConsumer.forRoutes() de NestJS en el adaptador Fastify, un cliente no autenticado puede omitir el middleware de Nest registrado para esa ruta simplemente añadiendo una barra inclinada final (/) a la URL de la solicitud. Esta omisión funciona en la configuración predeterminada del adaptador Fastify. Esta vulnerabilidad está corregida en la versión 11.1.24.

Information

Published : 2026-06-22 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54281

Mitre link : CVE-2026-54281

CVE.ORG link : CVE-2026-54281

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-54281", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54281", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nestjs", "product": "nest", "versions": [{"status": "affected", "version": "< 11.1.24"}]}]}], "published": "2026-06-22T22:16:49.433", "references": [{"url": "https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24."}, {"lang": "es", "value": "Nest es un framework para construir aplicaciones escalables de servidor Node.js. Antes de la versi\u00f3n 11.1.24, existe una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en @nestjs/platform-fastify. Cuando el middleware se registra a trav\u00e9s de la API MiddlewareConsumer.forRoutes() de NestJS en el adaptador Fastify, un cliente no autenticado puede omitir el middleware de Nest registrado para esa ruta simplemente a\u00f1adiendo una barra inclinada final (/) a la URL de la solicitud. Esta omisi\u00f3n funciona en la configuraci\u00f3n predeterminada del adaptador Fastify. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 11.1.24."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}