Packages / @nestjs/platform-fastify / Security
Nest: Middleware Bypass on Fastify via Trailing Slash
Affected releases · @nestjs/platform-fastify
- 11.x11.0.0 – 11.1.23Fixed in 11.1.24
- 10.x10.0.0 – 10.4.22No fix on this line yet
- 9.x and older6.0.0 – 9.4.3No fix, no longer updated
On 11.x, the newest line:
npm install @nestjs/platform-fastify@11.1.24Not affected
12.0.0 – 12.2.0
10 releases, latest
Affected
11.0.0 – 11.1.23
46 releases
Fixed
11.1.24 – 11.2.7
14 releases
Affected
10.0.0 – 10.4.22
55 releases
Affected
9.0.0 – 9.4.3
37 releases
Affected
8.0.0 – 8.4.7
32 releases
Affected
7.0.0 – 7.6.18
51 releases
Affected
6.0.0 – 6.11.11
67 releases
Is your project affected?
Paste your package.json, or type the range you declare for @nestjs/platform-fastify. It is read in your browser and sent nowhere.
What happens
Impact
An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.
This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.
Patches
Fixed in @nestjs/platform-fastify@11.1.24
References
Kudos goes to @a-tt-om