Middleware Bypass Vulnerability in NestJS Fastify Framework

CVE-2026-33011

What is CVE-2026-33011?

In NestJS versions 11.1.15 and earlier, a vulnerability exists within the @nestjs/platform-fastify GET middleware that allows it to be bypassed. This occurs due to Fastify's behavior of automatically redirecting HEAD requests to their corresponding GET handlers, bypassing the middleware entirely. Consequently, the HTTP response omits a body because it is truncated when a HEAD request is redirected to a GET handler. The underlying handler is still executed, potentially exposing sensitive logic or data. This issue has been addressed in version 11.1.16.

References