Authentication Bypass in NestJS Fastify Framework
CVE-2026-54281

8.7HIGH

Key Information:

Vendor

Nestjs

Status
Nest
Vendor
CVE Published:
22 June 2026

What is CVE-2026-54281?

An authentication bypass vulnerability exists in the NestJS Fastify framework affecting versions prior to 11.1.24. When using the MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass registered NestJS middleware for a route simply by appending a trailing slash to the request URL. This issue arises with the default Fastify adapter configuration and poses a significant risk if not addressed. Users are encouraged to upgrade to version 11.1.24 or later to mitigate this security concern.

Affected Version(s)

nest < 11.1.24

References

https://github.com/nestjs/nest/security/advisories/GHSA-6...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.