GHSA-9c5c-9qcx-q35q: @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
On the Fastify adapter, an HTTP request that uses an absolute-form request target (GET http://host/path HTTP/1.1
instead of GET /path HTTP/1.1) reaches the route handler without running the path-scoped Nest middleware bound to
that route. Applications that enforce authentication or authorization in middleware execute the protected handler
with those checks skipped.
References
- github.com/advisories/GHSA-9c5c-9qcx-q35q
- github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8
- github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621
- github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7
- github.com/nestjs/nest/pull/17737
- github.com/nestjs/nest/releases/tag/v11.2.4
- github.com/nestjs/nest/releases/tag/v12.0.2
- github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q
Code Behaviors & Features
Detect and mitigate GHSA-9c5c-9qcx-q35q with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →