{"id":"GHSA-c987-fv5x-hmpg","kind":"vulnerability","aliases":["GHSA-c987-fv5x-hmpg"],"related":[],"title":"Path-scoped middleware bypass on Fastify via an empty route parameter","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/platform-fastify` |\n| Affected versions | `< 11.2.8` and `>= 12.0.0, < 12.1.3` |\n| Patched versions | `11.2.8` and `12.1.3` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` (8.1) |\n| CWE | CWE-436 (Interpretation Conflict), CWE-288 (Authentication Bypass Using an Alternate Path or Channel) |\n\n### Summary\n\nOn the Fastify adapter, a request that left a route parameter empty could reach the route handler, with an empty\nparameter value, without running the Nest middleware bound to that route through `MiddlewareConsumer.forRoutes(...)`.\nApplications that enforce authentication or authorization in middleware could run the protected handler with those\nchecks skipped.\n\n### Impact\n\nAn application is affected if it uses `@nestjs/platform-fastify` and binds middleware to routes that have path\nparameters, for example `forRoutes(UsersController)`. No special router options are needed. Routes declared with\n`@All()` were affected as well.\n\n### Details\n\nFastify's router accepts an empty value for a path parameter, while Nest matched middleware paths with a pattern that\nrequires at least one character per parameter. For such a request the route matched but the middleware did not.\n\n### Patches\n\nFixed in **11.2.8** and **12.1.3**. A request that leaves a route parameter empty is now treated as a route miss and\nanswered with 404, as on the Express adapter. `@All()` routes are covered too.\n\n### Workarounds\n\nEnforce authentication and authorization in guards, which run for the matched route, rather than in middleware.\n\n### Credit\n\nFound by the NestJS maintainers.","summary":"On the Fastify adapter of NestJS, a request with an empty route parameter reaches the route handler without running the middleware bound to that route. An attacker can therefore run protected handlers while authentication or authorization checks placed in middleware are skipped.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/platform-fastify","fixed":["12.1.3"],"affected":">= 12.0.0, < 12.1.3","ecosystem":"npm"},{"name":"@nestjs/platform-fastify","fixed":["11.2.8"],"affected":"< 11.2.8","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-288","cwe-436","fastify","nestjs","node","package","self-hosted"],"not_affected_if":["auth-in-guards","express-adapter","no-path-parameters-in-middleware-routes"],"how_to_check":"- Check the installed version: `npm ls @nestjs/platform-fastify`\n- Look for `@nestjs/platform-fastify` in package.json and confirm the version is `11.2.8` or later on the 11 line, or `12.1.3` or later on the 12 line\n- Search the code for `forRoutes(` on controllers with path parameters that rely on middleware for auth","fix":"- `@nestjs/platform-fastify` 11.x: `11.2.8`\n- `@nestjs/platform-fastify` 12.x: `12.1.3`","status":"open","published_at":"2026-11-12T13:53:56+00:00","first_seen_at":"2026-11-12T13:56:25+00:00","triaged_at":"2026-11-12T13:57:23+00:00","updated_at":"2026-11-12T13:57:23+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T13:57:23Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/platform-fastify` 11.x: `11.2.8`\n- `@nestjs/platform-fastify` 12.x: `12.1.3`","reach":"internet","title":"NestJS Fastify adapter: empty route parameter skips path-scoped middleware","impact":"high","summary":"On the Fastify adapter of NestJS, a request with an empty route parameter reaches the route handler without running the middleware bound to that route. An attacker can therefore run protected handlers while authentication or authorization checks placed in middleware are skipped.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","fastify","node","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Protected route handlers run without middleware auth checks","analyst_note":"","how_to_check":"- Check the installed version: `npm ls @nestjs/platform-fastify`\n- Look for `@nestjs/platform-fastify` in package.json and confirm the version is `11.2.8` or later on the 11 line, or `12.1.3` or later on the 12 line\n- Search the code for `forRoutes(` on controllers with path parameters that rely on middleware for auth","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["express-adapter","auth-in-guards","no-path-parameters-in-middleware-routes"],"who_is_affected":"Applications that use @nestjs/platform-fastify and bind middleware with MiddlewareConsumer.forRoutes to routes that have path parameters, such as forRoutes(UsersController), are exposed. Authentication or authorization enforced only in guards is not affected, and applications that use the Express adapter are not listed as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000837,"input_tokens":5199,"output_tokens":635,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-288':26B,115C '-436':28B,111C '11.2.8':86C,92C,254C '12.0.0':88C '12.1.3':89C,94C,256C '404':275C '8.1':108C 'accept':215C 'adapt':39B,128C,280C 'affect':84C,179C,208C 'altern':120C 'answer':273C 'applic':158C,177C 'attack':62B 'authent':69B,116C,161C,288C 'author':71B,163C,290C 'av':99C 'bind':185C 'bound':57B,152C 'bypass':5A,117C 'c987':15A,20A 'channel':123C 'charact':236C 'check':72B,173C 'conflict':113C 'could':137C,166C 'cover':284C 'credit':303C 'cvss':97C 'cwe':25B,27B,109C,110C,114C 'declar':204C 'detail':211C 'ecosystem':80C 'empti':10A,46B,136C,144C,217C,264C 'enforc':160C,287C 'exampl':194C 'express':279C 'fastifi':7A,29B,38B,127C,212C 'field':78C 'fix':252C 'forrout':195C 'found':304C 'fv5x':16A,21A 'ghsa':14A,19A 'ghsa-c987-fv5x-hmpg':13A,18A 'guard':292C 'h/a':106C 'h/i':105C 'h/pr':101C 'handler':52B,67B,141C,170C 'high':96C 'hmpg':17A,22A 'host':35B 'impact':175C 'interpret':112C 'least':234C 'leav':260C 'left':132C 'maintain':308C 'match':225C,245C,297C 'middlewar':4A,56B,75B,151C,165C,186C,226C,248C,302C 'middlewareconsumer.forroutes':157C 'miss':271C 'n':107C 'n/ac':100C 'n/s':103C 'n/ui':102C 'need':202C 'nest':150C,224C 'nestj':30B,41B,307C 'nestjs/platform-fastify':23A,24A,83C,183C 'node':31B 'npm':81C 'one':235C 'option':200C 'packag':32B,82C 'paramet':12A,48B,135C,145C,192C,222C,238C,263C 'patch':90C,251C 'path':2A,121C,191C,221C,227C 'path-scop':1A 'pattern':230C 'per':237C 'place':73B 'protect':66B,169C 'rather':299C 'reach':49B,138C 'request':43B,130C,242C,258C 'requir':232C 'rout':11A,47B,51B,60B,134C,140C,155C,188C,203C,244C,262C,270C,282C,298C 'router':199C,214C 'run':54B,65B,148C,167C,294C 'scope':3A 'self':34B 'self-host':33B 'sever':95C 'skip':77B,174C 'special':198C 'summari':124C 'therefor':64B 'treat':267C 'u/c':104C 'use':118C,182C 'userscontrol':196C 'v3.1':98C 'valu':79C,146C,218C 'version':85C,91C 'via':8A 'well':210C 'without':53B,147C 'workaround':286C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @nestjs/platform-fastify and bind middleware with MiddlewareConsumer.forRoutes to routes that have path parameters, such as forRoutes(UsersController), are exposed. Authentication or authorization enforced only in guards is not affected, and applications that use the Express adapter are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["platformfastify"],"ptokens":["fastify","nestjs","platform"],"labels":["cwe288","cwe436","fastify","high","nestjs","node","npm","package","selfhosted"],"campaign_type":null,"search_a":"'bypass':5A 'c987':15A,20A 'empti':10A 'fastifi':7A 'fv5x':16A,21A 'ghsa':14A,19A 'ghsa-c987-fv5x-hmpg':13A,18A 'hmpg':17A,22A 'middlewar':4A 'nestjs/platform-fastify':23A,24A 'paramet':12A 'path':2A 'path-scop':1A 'rout':11A 'scope':3A 'via':8A","search_b":"'-288':26B '-436':28B 'adapt':39B 'attack':62B 'authent':69B 'author':71B 'bound':57B 'check':72B 'cwe':25B,27B 'empti':46B 'fastifi':29B,38B 'handler':52B,67B 'host':35B 'middlewar':56B,75B 'nestj':30B,41B 'node':31B 'packag':32B 'paramet':48B 'place':73B 'protect':66B 'reach':49B 'request':43B 'rout':47B,51B,60B 'run':54B,65B 'self':34B 'self-host':33B 'skip':77B 'therefor':64B 'without':53B","search_c":"'-288':115C '-436':111C '11.2.8':86C,92C,254C '12.0.0':88C '12.1.3':89C,94C,256C '404':275C '8.1':108C 'accept':215C 'adapt':128C,280C 'affect':84C,179C,208C 'altern':120C 'answer':273C 'applic':158C,177C 'authent':116C,161C,288C 'author':163C,290C 'av':99C 'bind':185C 'bound':152C 'bypass':117C 'channel':123C 'charact':236C 'check':173C 'conflict':113C 'could':137C,166C 'cover':284C 'credit':303C 'cvss':97C 'cwe':109C,110C,114C 'declar':204C 'detail':211C 'ecosystem':80C 'empti':136C,144C,217C,264C 'enforc':160C,287C 'exampl':194C 'express':279C 'fastifi':127C,212C 'field':78C 'fix':252C 'forrout':195C 'found':304C 'guard':292C 'h/a':106C 'h/i':105C 'h/pr':101C 'handler':141C,170C 'high':96C 'impact':175C 'interpret':112C 'least':234C 'leav':260C 'left':132C 'maintain':308C 'match':225C,245C,297C 'middlewar':151C,165C,186C,226C,248C,302C 'middlewareconsumer.forroutes':157C 'miss':271C 'n':107C 'n/ac':100C 'n/s':103C 'n/ui':102C 'need':202C 'nest':150C,224C 'nestj':307C 'nestjs/platform-fastify':83C,183C 'npm':81C 'one':235C 'option':200C 'packag':82C 'paramet':135C,145C,192C,222C,238C,263C 'patch':90C,251C 'path':121C,191C,221C,227C 'pattern':230C 'per':237C 'protect':169C 'rather':299C 'reach':138C 'request':130C,242C,258C 'requir':232C 'rout':134C,140C,155C,188C,203C,244C,262C,270C,282C,298C 'router':199C,214C 'run':148C,167C,294C 'sever':95C 'skip':174C 'special':198C 'summari':124C 'treat':267C 'u/c':104C 'use':118C,182C 'userscontrol':196C 'v3.1':98C 'valu':79C,146C,218C 'version':85C,91C 'well':210C 'without':147C 'workaround':286C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:53:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-c987-fv5x-hmpg","url":"https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg","severity":"high","published_at":"2026-11-12T13:53:56+00:00","modified_at":"2026-11-12T13:53:56+00:00","first_seen_at":"2026-11-12T13:56:25+00:00","fetched_at":"2026-11-12T14:57:11+00:00","note":null}],"documents":[{"id":135292,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}