Middleware Bypass Vulnerability in NestJS Fastify Framework

CVE-2026-33011

What is CVE-2026-33011?

In NestJS versions 11.1.15 and earlier, a vulnerability exists within the @nestjs/platform-fastify GET middleware that allows it to be bypassed. This occurs due to Fastify's behavior of automatically redirecting HEAD requests to their corresponding GET handlers, bypassing the middleware entirely. Consequently, the HTTP response omits a body because it is truncated when a HEAD request is redirected to a GET handler. The underlying handler is still executed, potentially exposing sensitive logic or data. This issue has been addressed in version 11.1.16.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References