Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. @nestjs/platform-fastify
  4. ›
  5. GHSA-9c5c-9qcx-q35q

GHSA-9c5c-9qcx-q35q: @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

September 30, 2026

On the Fastify adapter, an HTTP request that uses an absolute-form request target (GET http://host/path HTTP/1.1 instead of GET /path HTTP/1.1) reaches the route handler without running the path-scoped Nest middleware bound to that route. Applications that enforce authentication or authorization in middleware execute the protected handler with those checks skipped.

References

  • github.com/advisories/GHSA-9c5c-9qcx-q35q
  • github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8
  • github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621
  • github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7
  • github.com/nestjs/nest/pull/17737
  • github.com/nestjs/nest/releases/tag/v11.2.4
  • github.com/nestjs/nest/releases/tag/v12.0.2
  • github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q

Code Behaviors & Features

Detect and mitigate GHSA-9c5c-9qcx-q35q with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 11.2.4, all versions starting from 12.0.0 before 12.0.2

Fixed versions

  • 11.2.4
  • 12.0.2

Solution

Upgrade to versions 11.2.4, 12.0.2 or above.

Impact 7.4 HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-288: Authentication Bypass Using an Alternate Path or Channel
  • CWE-436: Interpretation Conflict

Source file

npm/@nestjs/platform-fastify/GHSA-9c5c-9qcx-q35q.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Mon, 12 Oct 2026 00:22:11 +0000.