---
id: "GHSA-c987-fv5x-hmpg"
page: "https://infrastack.ai/live/GHSA-c987-fv5x-hmpg"
kind: "vulnerability"
aliases: ["GHSA-c987-fv5x-hmpg"]
title: "Path-scoped middleware bypass on Fastify via an empty route parameter"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@nestjs/platform-fastify", "fixed": ["12.1.3"], "affected": ">= 12.0.0, < 12.1.3", "ecosystem": "npm"}, {"name": "@nestjs/platform-fastify", "fixed": ["11.2.8"], "affected": "< 11.2.8", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-288", "cwe-436", "fastify", "nestjs", "node", "package", "self-hosted"]
not_affected_if: ["auth-in-guards", "express-adapter", "no-path-parameters-in-middleware-routes"]
published_at: "2026-11-12T13:53:56+00:00"
first_seen_at: "2026-11-12T13:56:25+00:00"
updated_at: "2026-11-12T13:57:23+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg", "first_seen_at": "2026-11-12T13:56:25+00:00"}]
exploit_sources: []
---

# Path-scoped middleware bypass on Fastify via an empty route parameter

Link for people: https://infrastack.ai/live/GHSA-c987-fv5x-hmpg (this .md is for agents)

On the Fastify adapter of NestJS, a request with an empty route parameter reaches the route handler without running the middleware bound to that route. An attacker can therefore run protected handlers while authentication or authorization checks placed in middleware are skipped.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@nestjs/platform-fastify affected >= 12.0.0, < 12.1.3 fixed 12.1.3
- npm:@nestjs/platform-fastify affected < 11.2.8 fixed 11.2.8

## How to check

- Check the installed version: `npm ls @nestjs/platform-fastify`
- Look for `@nestjs/platform-fastify` in package.json and confirm the version is `11.2.8` or later on the 11 line, or `12.1.3` or later on the 12 line
- Search the code for `forRoutes(` on controllers with path parameters that rely on middleware for auth

## Fix

- `@nestjs/platform-fastify` 11.x: `11.2.8`
- `@nestjs/platform-fastify` 12.x: `12.1.3`

## Timeline

- 2026-11-12T13:56:25+00:00 ghsa-repo https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg

## From the sources

| Field | Value |
| --- | --- |
| Ecosystem | npm |
| Package | `@nestjs/platform-fastify` |
| Affected versions | `< 11.2.8` and `>= 12.0.0, < 12.1.3` |
| Patched versions | `11.2.8` and `12.1.3` |
| Severity | High |
| CVSS v3.1 | `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N` (8.1) |
| CWE | CWE-436 (Interpretation Conflict), CWE-288 (Authentication Bypass Using an Alternate Path or Channel) |

### Summary

On the Fastify adapter, a request that left a route parameter empty could reach the route handler, with an empty
parameter value, without running the Nest middleware bound to that route through `MiddlewareConsumer.forRoutes(...)`.
Applications that enforce authentication or authorization in middleware could run the protected handler with those
checks skipped.

### Impact

An application is affected if it uses `@nestjs/platform-fastify` and binds middleware to routes that have path
parameters, for example `forRoutes(UsersController)`. No special router options are needed. Routes declared with
`@All()` were affected as well.

### Details

Fastify's router accepts an empty value for a path parameter, while Nest matched middleware paths with a pattern that
requires at least one character per parameter. For such a request the route matched but the middleware did not.

### Patches

Fixed in **11.2.8** and **12.1.3**. A request that leaves a route parameter empty is now treated as a route miss and
answered with 404, as on the Express adapter. `@All()` routes are covered too.

### Workarounds

Enforce authentication and authorization in guards, which run for the matched route, rather than in middleware.

### Credit

Found by the NestJS maintainers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_