GHSA-9c5c-9qcx-q35q: @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
On the Fastify adapter, an HTTP request that uses an absolute-form request target (GET http://host/path HTTP/1.1
instead of GET /path HTTP/1.1) reaches the route handler without running the path-scoped Nest middleware bound to
that route. Applications that enforce authentication or authorization in middleware execute the protected handler
with those checks skipped.
References
- github.com/advisories/GHSA-9c5c-9qcx-q35q
- github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8
- github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621
- github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7
- github.com/nestjs/nest/pull/17737
- github.com/nestjs/nest/releases/tag/v11.2.4
- github.com/nestjs/nest/releases/tag/v12.0.2
- github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q
Code Behaviors & Features
Detect and mitigate GHSA-9c5c-9qcx-q35q with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →