@NESTJS/PLATFORM-FASTIFY · GHSA-c987-fv5x-hmpg · Package
FIX → 12.1.3 · 11.2.8
On the Fastify adapter of NestJS, a request with an empty route parameter reaches the route handler without running the middleware bound to that route. An attacker can therefore run protected handlers while authentication or authorization checks placed in middleware are skipped.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use @nestjs/platform-fastify and bind middleware with MiddlewareConsumer.forRoutes to routes that have path parameters, such as forRoutes(UsersController), are exposed. Authentication or authorization enforced only in guards is not affected, and applications that use the Express adapter are not listed as affected.
Not affected if auth-in-guards, express-adapter, no-path-parameters-in-middleware-routes
Who cares fastify, nestjs, node, self-hosted
npm ls @nestjs/platform-fastify@nestjs/platform-fastify in package.json and confirm the version is 11.2.8 or later on the 11 line, or 12.1.3 or later on the 12 lineforRoutes( on controllers with path parameters that rely on middleware for auth| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/platform-fastify |
| Affected versions | < 11.2.8 and >= 12.0.0, < 12.1.3 |
| Patched versions | 11.2.8 and 12.1.3 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (8.1) |
| CWE | CWE-436 (Interpretation Conflict), CWE-288 (Authentication Bypass Using an Alternate Path or Channel) |
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 12.1.3 · 11.2.8
@nestjs/platform-fastify 11.x: 11.2.8@nestjs/platform-fastify 12.x: 12.1.3On the Fastify adapter, a request that left a route parameter empty could reach the route handler, with an empty
parameter value, without running the Nest middleware bound to that route through MiddlewareConsumer.forRoutes(...).
Applications that enforce authentication or authorization in middleware could run the protected handler with those
checks skipped.
An application is affected if it uses @nestjs/platform-fastify and binds middleware to routes that have path
parameters, for example forRoutes(UsersController). No special router options are needed. Routes declared with
@All() were affected as well.
Fastify's router accepts an empty value for a path parameter, while Nest matched middleware paths with a pattern that requires at least one character per parameter. For such a request the route matched but the middleware did not.
Fixed in 11.2.8 and 12.1.3. A request that leaves a route parameter empty is now treated as a route miss and
answered with 404, as on the Express adapter. @All() routes are covered too.
Enforce authentication and authorization in guards, which run for the matched route, rather than in middleware.
Found by the NestJS maintainers.