CVSS 4.0
8.2 highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NCVE-2026-2293
High (8.2) in nestjs nest. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in @nestjs/platform-fastify 11.1.14.
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled.
This issue affects nest.Js: 11.1.13.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-863, CWE-551
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nestjs:nest
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r4wm-x892-vjmx | npm | @nestjs/platform-fastify | <11.1.14 | 11.1.14 |