Vulnerability-Lookup

GHSA-9C5C-9QCX-Q35Q

Vulnerability from github – Published: 2026-09-30 14:41 – Updated: 2026-09-30 14:41

Summary

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

Details

Field	Value
Ecosystem	npm
Package	`@nestjs/platform-fastify`
Affected versions	`>= 12.0.0, < 12.0.2` and `< 11.2.4`
Patched versions	`12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`)

Summary

On the Fastify adapter, an HTTP request that uses an absolute-form request target (GET http://host/path HTTP/1.1 instead of GET /path HTTP/1.1) reaches the route handler without running the path-scoped Nest middleware bound to that route. Applications that enforce authentication or authorization in middleware execute the protected handler with those checks skipped.

Impact

Any application that

uses @nestjs/platform-fastify, and
binds middleware to specific paths via MiddlewareConsumer.forRoutes(...) or .exclude(...), and
is reachable by a client that controls the raw request line.

Node's HTTP server accepts absolute-form targets, so no special server configuration is needed. Exposure is reduced when a reverse proxy in front of the application rewrites the request target to origin-form, which most do.

Where the bypassed middleware performs authentication or authorization, the result is an authentication or authorization bypass. Where it performs logging, rate limiting or body handling, those are silently skipped instead.

Details

Fastify's router (find-my-way) resolves an absolute-form target to its path before matching, so the route handler is dispatched normally. Two places on the middleware side matched against the raw request target instead:

The bundled copy of the @fastify/middie engine at packages/platform-fastify/adapters/middie/fastify-middie.ts. NestJS carried this fork to apply an earlier path-decoding fix and it did not track the upstream absolute-form fix released in @fastify/middie@9.3.4.
FastifyAdapter's own re-check in createMiddlewareFactory(), which tests the middleware path regexp against req.originalUrl.

Both normalized and percent-decoded the target, but neither resolved absolute-form to a path, so the router and the middleware layer disagreed about which path was being requested.

A second, related defect contributed. Because the adapter always passes routerOptions (to install the version constraint), Fastify did not reflect the deprecated top-level router options (ignoreTrailingSlash, ignoreDuplicateSlashes, caseSensitive, useSemicolonDelimiter) in initialConfig.routerOptions, which is what the middleware engine reads. Applications passing those options at the top level had middleware normalize paths differently from the router, which widened the mismatch.

Proof of concept

@Controller('users')
export class UsersController {
  @Get()
  findAll() {
    return 'protected data';
  }
}

@Module({ controllers: [UsersController] })
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply((req, res) => res.end('blocked by auth middleware'))
      .forRoutes({ path: 'users', method: RequestMethod.GET });
  }
}

supertest and light-my-request always emit origin-form targets, so the request has to be written to the socket:

const { connect } = require('node:net');

const socket = connect(3000, '127.0.0.1', () => {
  socket.write(
    'GET http://127.0.0.1:3000/users HTTP/1.1\r\n' +
      'Host: 127.0.0.1:3000\r\n' +
      'Connection: close\r\n\r\n',
  );
});
socket.pipe(process.stdout);

Observed on an affected version: protected data — the middleware did not run. Expected, and observed on a patched version: blocked by auth middleware.

Patches

Fixed in 12.0.2 and 11.2.4. Upgrading to 12.0.3 or 11.2.5 is recommended.

The bundled @fastify/middie fork was removed and the package now depends on @fastify/middie@9.3.4, which resolves absolute-form targets before matching.
The adapter resolves absolute-form targets in its own route check, mirroring find-my-way.
Deprecated top-level Fastify router options are folded into routerOptions so the middleware engine and the router normalize paths identically.

Workarounds

If you cannot upgrade, reject non-origin-form request targets before middleware runs. Register the hook on the Fastify instance before the application is initialized, so that it runs ahead of the middleware engine's own onRequest hook, and confirm with the request above that the rejection takes effect:

const adapter = new FastifyAdapter();
adapter.getInstance().addHook('onRequest', (request, reply, done) => {
  const target = request.raw.url ?? '';
  // "*" is the legitimate request target of "OPTIONS * HTTP/1.1"
  if (target[0] !== '/' && target !== '*') {
    reply.code(400).send();
    return;
  }
  done();
});

Rejecting or normalizing absolute-form targets at a reverse proxy in front of the application is equally effective.

Credit

Reported by ZeroVuln Labs.

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nestjs/platform-fastify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nestjs/platform-fastify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "12.0.0"
            },
            {
              "fixed": "12.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-436"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T14:41:39Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/platform-fastify` |\n| Affected versions | `\u003e= 12.0.0, \u003c 12.0.2` and `\u003c 11.2.4` |\n| Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) |\n\n### Summary\n\nOn the Fastify adapter, an HTTP request that uses an **absolute-form request target** (`GET http://host/path HTTP/1.1`\ninstead of `GET /path HTTP/1.1`) reaches the route handler without running the path-scoped Nest middleware bound to\nthat route. Applications that enforce authentication or authorization in middleware execute the protected handler\nwith those checks skipped.\n\n### Impact\n\nAny application that\n\n- uses `@nestjs/platform-fastify`, and\n- binds middleware to specific paths via `MiddlewareConsumer.forRoutes(...)` or `.exclude(...)`, and\n- is reachable by a client that controls the raw request line.\n\nNode\u0027s HTTP server accepts absolute-form targets, so no special server configuration is needed. Exposure is reduced\nwhen a reverse proxy in front of the application rewrites the request target to origin-form, which most do.\n\nWhere the bypassed middleware performs authentication or authorization, the result is an authentication or\nauthorization bypass. Where it performs logging, rate limiting or body handling, those are silently skipped instead.\n\n### Details\n\nFastify\u0027s router (`find-my-way`) resolves an absolute-form target to its path before matching, so the route handler\nis dispatched normally. Two places on the middleware side matched against the **raw** request target instead:\n\n1. The bundled copy of the `@fastify/middie` engine at `packages/platform-fastify/adapters/middie/fastify-middie.ts`.\n   NestJS carried this fork to apply an earlier path-decoding fix and it did not track the upstream absolute-form fix\n   released in `@fastify/middie@9.3.4`.\n2. `FastifyAdapter`\u0027s own re-check in `createMiddlewareFactory()`, which tests the middleware path regexp against\n   `req.originalUrl`.\n\nBoth normalized and percent-decoded the target, but neither resolved absolute-form to a path, so the router and the\nmiddleware layer disagreed about which path was being requested.\n\nA second, related defect contributed. Because the adapter always passes `routerOptions` (to install the version\nconstraint), Fastify did not reflect the deprecated **top-level** router options (`ignoreTrailingSlash`,\n`ignoreDuplicateSlashes`, `caseSensitive`, `useSemicolonDelimiter`) in `initialConfig.routerOptions`, which is what\nthe middleware engine reads. Applications passing those options at the top level had middleware normalize paths\ndifferently from the router, which widened the mismatch.\n\n### Proof of concept\n\n```ts\n@Controller(\u0027users\u0027)\nexport class UsersController {\n  @Get()\n  findAll() {\n    return \u0027protected data\u0027;\n  }\n}\n\n@Module({ controllers: [UsersController] })\nexport class AppModule implements NestModule {\n  configure(consumer: MiddlewareConsumer) {\n    consumer\n      .apply((req, res) =\u003e res.end(\u0027blocked by auth middleware\u0027))\n      .forRoutes({ path: \u0027users\u0027, method: RequestMethod.GET });\n  }\n}\n```\n\n`supertest` and `light-my-request` always emit origin-form targets, so the request has to be written to the socket:\n\n```js\nconst { connect } = require(\u0027node:net\u0027);\n\nconst socket = connect(3000, \u0027127.0.0.1\u0027, () =\u003e {\n  socket.write(\n    \u0027GET http://127.0.0.1:3000/users HTTP/1.1\\r\\n\u0027 +\n      \u0027Host: 127.0.0.1:3000\\r\\n\u0027 +\n      \u0027Connection: close\\r\\n\\r\\n\u0027,\n  );\n});\nsocket.pipe(process.stdout);\n```\n\nObserved on an affected version: `protected data` \u2014 the middleware did not run.\nExpected, and observed on a patched version: `blocked by auth middleware`.\n\n### Patches\n\nFixed in **12.0.2** and **11.2.4**. Upgrading to **12.0.3** or **11.2.5** is recommended.\n\n- The bundled `@fastify/middie` fork was removed and the package now depends on `@fastify/middie@9.3.4`, which\n  resolves absolute-form targets before matching.\n- The adapter resolves absolute-form targets in its own route check, mirroring `find-my-way`.\n- Deprecated top-level Fastify router options are folded into `routerOptions` so the middleware engine and the\n  router normalize paths identically.\n\n### Workarounds\n\nIf you cannot upgrade, reject non-origin-form request targets before middleware runs. Register the hook on the\nFastify instance **before the application is initialized**, so that it runs ahead of the middleware engine\u0027s own\n`onRequest` hook, and confirm with the request above that the rejection takes effect:\n\n```ts\nconst adapter = new FastifyAdapter();\nadapter.getInstance().addHook(\u0027onRequest\u0027, (request, reply, done) =\u003e {\n  const target = request.raw.url ?? \u0027\u0027;\n  // \"*\" is the legitimate request target of \"OPTIONS * HTTP/1.1\"\n  if (target[0] !== \u0027/\u0027 \u0026\u0026 target !== \u0027*\u0027) {\n    reply.code(400).send();\n    return;\n  }\n  done();\n});\n```\n\nRejecting or normalizing absolute-form targets at a reverse proxy in front of the application is equally effective.\n\n### Credit\n\nReported by ZeroVuln Labs.",
  "id": "GHSA-9c5c-9qcx-q35q",
  "modified": "2026-09-30T14:41:39Z",
  "published": "2026-09-30T14:41:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/pull/17737"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nestjs/nest"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/releases/tag/v11.2.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/releases/tag/v12.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-9C5C-9QCX-Q35Q

Summary

Impact

Details

Proof of concept

Patches

Workarounds

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour