Description
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled.
This issue affects nest.Js: 11.1.13.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nest.js | nest.js | 11.1.13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @nestjs/platform-fastify | < 11.1.14 | 11.1.14 | GHSA-r4wm-x892-vjmx |
References
- https://fluidattacks.com/advisories/neton third-party-advisory
- https://github.com/nestjs/nest/ product
- https://github.com/nestjs/nest/releases/tag/v11.1.14 patch