{"id":"CVE-2026-54281","aliases":["GHSA-6v32-fjc9-9qf6"],"title":"Nest: Middleware Bypass on Fastify via Trailing Slash","summary":"Nest: Middleware Bypass on Fastify via Trailing Slash","severity":"high","cwe":["CWE-863"],"vendor":"nestjs","product":"@nestjs/platform-fastify","ecosystem":"npm","affected":["@nestjs/platform-fastify <= 11.1.23"],"patched":["@nestjs/platform-fastify 11.1.24"],"published":"2026-06-15","updated":"2026-06-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6v32-fjc9-9qf6","references":[{"url":"https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6"},{"url":"https://github.com/advisories/GHSA-6v32-fjc9-9qf6"}],"tags":["ghsa","npm"],"epss":0.00498,"epssPercentile":0.40149,"ingestedAt":"2026-07-07T15:41:58.638Z","slug":"CVE-2026-54281","body":"## Overview\n\n### Impact\n\nAn authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS's `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL.\n\nThis bypass works on the **default Fastify adapter configuration** — no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware.\n\n### Patches\n\nFixed in `@nestjs/platform-fastify@11.1.24`\n\n### References\n\nKudos goes to @a-tt-om\n\n## Affected packages\n\n- `@nestjs/platform-fastify <= 11.1.23`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@nestjs/platform-fastify 11.1.24`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}