Packages / @nestjs/platform-fastify / Security
Nest Fastify HEAD Request Middleware Bypass
Affected releases · @nestjs/platform-fastify
- 11.x11.0.0 – 11.1.15Fixed in 11.1.16
- 10.x10.0.0 – 10.4.22No fix on this line yet
- 9.x and older6.0.0 – 9.4.3No fix, no longer updated
On 11.x, the newest line:
npm install @nestjs/platform-fastify@11.1.16Not affected
12.0.0 – 12.2.0
10 releases, latest
Affected
11.0.0 – 11.1.15
38 releases
Fixed
11.1.16 – 11.2.7
22 releases
Affected
10.0.0 – 10.4.22
55 releases
Affected
9.0.0 – 9.4.3
37 releases
Affected
8.0.0 – 8.4.7
32 releases
Affected
7.0.0 – 7.6.18
51 releases
Affected
6.0.0 – 6.11.11
67 releases
Is your project affected?
Paste your package.json, or type the range you declare for @nestjs/platform-fastify. It is read in your browser and sent nowhere.
What happens
Impact
In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).
As a result:
Middleware will be completely skipped.
The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
The actual handler will still be executed.
Patches
Fixed in @nestjs/platform-fastify@11.1.16