CVE-2026-2293

Nest has a Fastify URL Encoding Middleware Bypass

References

Credit goes to Fluidattacks (Cristian Vargas) https://fluidattacks.com/advisories/neton

What kind of vulnerability is it? Who is impacted?

A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options (e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.

The bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.

Nest passes Fastify routerOptions (such as ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.

But middleware execution is decided by a separate regex check over req.originalUrl in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.

If that regex does not match, Nest does next() and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.

This is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.

The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.

Kodem intelligence

Already deployed Kodem?

Fixed in @nestjs/[email protected]

1. What is CVE-2026-2293? CVE-2026-2293 is a high-severity incorrect authorization vulnerability in @nestjs/platform-fastify (npm), affecting versions <= 11.1.13. It is fixed in 11.1.14. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
2. Which versions of @nestjs/platform-fastify are affected by CVE-2026-2293? @nestjs/platform-fastify (npm) versions <= 11.1.13 is affected.
3. Is there a fix for CVE-2026-2293? Yes. CVE-2026-2293 is fixed in 11.1.14. Upgrade to this version or later.
4. Is CVE-2026-2293 exploitable, and should I be worried? Whether CVE-2026-2293 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-2293 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-2293? Upgrade @nestjs/platform-fastify to 11.1.14 or later.

Other vulnerabilities in @nestjs/platform-fastify