CVE-2026-2293

CRITICAL

NestJS platform-fastify < 11.1.14 - Authentication Bypass via Fastify Path Normalization

Title source: llm

Description

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

References (6)

Core 6

Core References

Various Sources third-party-advisory

https://fluidattacks.com/advisories/neton

Various Sources product

https://github.com/nestjs/nest/

Release Notes patch

https://github.com/nestjs/nest/releases/tag/v11.1.14

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-2293

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2443367

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2293.json

Scores

CVSS v3 9.8

EPSS 0.0067

EPSS Percentile 48.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-551 CWE-863

Status published

Products (3)

nest.js/nest.js 11.1.13

nestjs/nest 11.1.13

nestjs/platform-fastify 0 - 11.1.14npm

Published Feb 27, 2026

Tracked Since Feb 28, 2026