Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.
oryginał ENCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNestjs Nest
APPNestjs< 11.1.11
Powiązane podatności
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker...
Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a N...
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middlewar...
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._trans...
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the C...