---
id: CVE-2026-54281
aliases:
  - GHSA-6v32-fjc9-9qf6
title: 'Nest: Middleware Bypass on Fastify via Trailing Slash'
summary: 'Nest: Middleware Bypass on Fastify via Trailing Slash'
severity: high
cwe:
  - CWE-863
vendor: nestjs
product: '@nestjs/platform-fastify'
ecosystem: npm
affected:
  - '@nestjs/platform-fastify <= 11.1.23'
patched:
  - '@nestjs/platform-fastify 11.1.24'
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6v32-fjc9-9qf6'
references:
  - url: 'https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6'
  - url: 'https://github.com/advisories/GHSA-6v32-fjc9-9qf6'
tags:
  - ghsa
  - npm
epss: 0.00498
epssPercentile: 0.40149
ingestedAt: '2026-07-07T15:41:58.638Z'
---

## Overview

### Impact

An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS's `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL.

This bypass works on the **default Fastify adapter configuration** — no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware.

### Patches

Fixed in `@nestjs/platform-fastify@11.1.24`

### References

Kudos goes to @a-tt-om

## Affected packages

- `@nestjs/platform-fastify <= 11.1.23`

## Remediation

Upgrade to a patched release:

- `@nestjs/platform-fastify 11.1.24`