Executive Summary

This vulnerability exists in the NestJS framework, specifically in the @nestjs/platform-fastify package before version 11.1.24. It allows an unauthenticated client to bypass the authentication middleware registered for certain routes when using the Fastify adapter. The bypass occurs if the client appends a trailing slash (/) to the request URL, causing the middleware to be skipped under the default Fastify configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized users to access protected routes or resources without proper authentication by exploiting the trailing slash bypass. This could lead to unauthorized access to sensitive data or functionality, potentially compromising the security of applications built with the affected NestJS versions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the @nestjs/platform-fastify package to version 11.1.24 or later, where the authentication bypass issue has been fixed.

Additionally, review your middleware registration using MiddlewareConsumer.forRoutes() on the Fastify adapter to ensure no unauthenticated access is possible via trailing slashes in request URLs.

Useful 0 Not Useful 0