CVE-2026-54281 Details
Description
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.
An authentication bypass vulnerability has been identified in the @nestjs/platform-fastify package, affecting versions through 11.1.23. The issue arises when middleware is applied using NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter. In this scenario, an unauthenticated client can circumvent the Nest middleware for that route by adding a trailing slash to the request URL. This vulnerability exploits the default Fastify adapter configuration, without requiring any special router options. It impacts applications using standard CRUD route patterns that are protected with MiddlewareConsumer.forRoutes() middleware.
The vulnerability has been fixed in @nestjs/platform-fastify version 11.1.24.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 22, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NestJS Nest | All versions |
CPE
Remediation
| |
| NestJS Platform-Fastify | <= 11.1.23 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |