CVE-2026-54281 | BDVDB-2026-342127 Detail

Description#

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-06-22Record published in the CVE List.
2. Version 22026-06-24Most recent update recorded in the CVE List.