Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. @nestjs/platform-fastify
  4. ›
  5. GHSA-9c5c-9qcx-q35q

GHSA-9c5c-9qcx-q35q: @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

September 30, 2026

On the Fastify adapter, an HTTP request that uses an absolute-form request target (GET http://host/path HTTP/1.1 instead of GET /path HTTP/1.1) reaches the route handler without running the path-scoped Nest middleware bound to that route. Applications that enforce authentication or authorization in middleware execute the protected handler with those checks skipped.

References

  • github.com/advisories/GHSA-9c5c-9qcx-q35q
  • github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8
  • github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621
  • github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7
  • github.com/nestjs/nest/pull/17737
  • github.com/nestjs/nest/releases/tag/v11.2.4
  • github.com/nestjs/nest/releases/tag/v12.0.2
  • github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q

Code Behaviors & Features

Detect and mitigate GHSA-9c5c-9qcx-q35q with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 11.2.4, all versions starting from 12.0.0 before 12.0.2

Fixed versions

  • 11.2.4
  • 12.0.2

Solution

Upgrade to versions 11.2.4, 12.0.2 or above.

Impact 7.4 HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-288: Authentication Bypass Using an Alternate Path or Channel
  • CWE-436: Interpretation Conflict

Source file

npm/@nestjs/platform-fastify/GHSA-9c5c-9qcx-q35q.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:00 +0000.