CVE-2026-2293: @nestjs/platform fastify Nest Has A Fastify URL Vulnerability
HIGHCVE-2026-2293 is a HIGH nest has a fastify url vulnerability (CWE-863: Incorrect Authorization) affecting @nestjs/platform fastify libraries in the npm ecosystem. The issue involves nest has a fastify url encoding middleware bypass. Remediation is available by upgrading affected packages to version 11.1.14.
CVE-2026-2293 at a Glance
How to Fix CVE-2026-2293
To remediate this vulnerability, upgrade all affected @nestjs/platform fastify dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @nestjs/platform-fastify@11.1.14Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @nestjs/platform-fastifyHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-2293, inspect your project dependencies using npm:
npm ls @nestjs/platform-fastifyAnalyze the terminal output to locate any version of @nestjs/platform fastify in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 11.1.14), your application is affected.
Note: The npm ls @nestjs/platform-fastify command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In @nestjs/platform fastify, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-2293 Affected @nestjs/platform fastify Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@nestjs/platform-fastify
|
npm |
< 11.1.14
|
11.1.14
|
References
Frequently Asked Questions
What is CVE-2026-2293?
Which @nestjs/platform fastify versions are affected?
What version fixes CVE-2026-2293?
Is @nestjs/platform-fastify affected?
What CWE is associated with CVE-2026-2293?
How can I check npm dependencies for CVE-2026-2293?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-r4wm-x892-vjmx",
"modified" : "2026-03-02T14:34:12Z",
"published" : "2026-03-02T14:34:12Z",
"aliases" : [ "CVE-2026-2293" ],
"summary" : "Nest has a Fastify URL Encoding Middleware Bypass ",
"details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA NestJS application using `@nestjs/platform-fastify` can allow bypass of any middleware when Fastify path-normalization options (e.g., `ignoreTrailingSlash`, `ignoreDuplicateSlashes`, `useSemicolonDelimiter`) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.\n\nThe bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.\n\nNest passes Fastify routerOptions (such as `ignoreTrailingSlash`, `ignoreDuplicateSlashes`, `useSemicolonDelimiter`) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.\n\nBut middleware execution is decided by a separate regex check over `req.originalUrl` in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.\n\nIf that regex does not match, Nest does `next()` and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.\n\nThis is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.\n\n### Patches\n\nFixed in `@nestjs/platform-fastify@11.1.14`\n\n### References\n\nCredit goes to Fluidattacks ([Cristian Vargas](https://www.linkedin.com/in/cvmiracle/)) https://fluidattacks.com/advisories/neton",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@nestjs/platform-fastify"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "11.1.14"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 11.1.13"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/nestjs/nest/security/advisories/GHSA-r4wm-x892-vjmx"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-2293"
}, {
"type" : "WEB",
"url" : "https://github.com/nestjs/nest/commit/fd8d073e0e048b185147209338ca7042e52c10ba"
}, {
"type" : "WEB",
"url" : "https://fluidattacks.com/advisories/neton"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/nestjs/nest"
}, {
"type" : "WEB",
"url" : "https://github.com/nestjs/nest/releases/tag/v11.1.14"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-863" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-02T14:34:12Z",
"nvd_published_at" : null
}
}