CVE-2025-69211
📋 TL;DR
NestJS applications using Fastify platform with route-specific middleware are vulnerable to URL encoding bypass. This allows attackers to access protected routes without authentication or authorization checks. Only applications using @nestjs/platform-fastify with middleware applied to specific routes are affected.
💻 Affected Systems
- NestJS
- @nestjs/platform-fastify
📦 What is this software?
Nest by Nestjs
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication/authorization bypass leading to unauthorized administrative access, data exposure, or privilege escalation.
Likely Case
Unauthorized access to protected endpoints, potentially exposing sensitive data or allowing unauthorized actions.
If Mitigated
Limited impact if additional security layers (application-level checks, network segmentation) are in place.
🎯 Exploit Status
Exploitation requires crafting specially encoded URLs to bypass middleware path matching
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: @nestjs/platform-fastify@11.1.11
Vendor Advisory: https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj
Restart Required: Yes
Instructions:
Update package.json to specify "@nestjs/platform-fastify": "^11.1.11"
Run: npm update @nestjs/platform-fastify
Restart the application
🔧 Temporary Workarounds
Switch to Express Platform
allTemporarily switch from Fastify to Express platform which is not affected
npm uninstall @nestjs/platform-fastify
npm install @nestjs/platform-express
Update main.ts to use ExpressAdapter
Apply Global Middleware
allApply security middleware globally instead of route-specific to avoid bypass
In AppModule: apply middleware globally using app.use() or MiddlewareConsumer without .forRoutes()
🧯 If You Can't Patch
- Implement additional authentication checks at controller/service level
- Use network-level access controls to restrict sensitive endpoints
🔍 How to Verify
Check if Vulnerable:
Check package.json for @nestjs/platform-fastify version <11.1.11 and verify route-specific middleware usageCheck Version:
npm list @nestjs/platform-fastifyVerify Fix Applied:
Verify package.json shows @nestjs/platform-fastify version >=11.1.11 and test protected routes with encoded URLs📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to protected routes
- Requests with encoded characters in URLs to middleware-protected endpoints
Network Indicators:
- HTTP requests to protected endpoints without authentication headers
- URLs with multiple encoding patterns
SIEM Query:
source="application_logs" AND (url CONTAINS "%" AND path IN ["protected_endpoints"])