Recommended action

Update @nestjs/platform-fastify to 11.1.24 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Nest: Middleware Bypass on Fastify via Trailing Slash affects @nestjs/platform-fastify (npm). Severity is high. ### Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS's `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL. This bypass works on the **default Fastify adapter configuration** — no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware. ### Patches Fixed in `@nestjs/[email protected]` ### References Kudos goes to @a-tt-om

AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update @nestjs/platform-fastify to 11.1.24 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Nest: Middleware Bypass on Fastify via Trailing Slash affects @nestjs/platform-fastify (npm). Severity is high. ### Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS's `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL. This bypass works on the **default Fastify adapter configuration** — no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware. ### Patches Fixed in `@nestjs/[email protected]` ### References Kudos goes to @a-tt-om

AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software