CVE-2025-69211: Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
A NestJS application is vulnerable if it meets all of the following criteria:
1. Platform: Uses @nestjs/platform-fastify. 2. Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use() 3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')). Example Vulnerable Config:
ts // app.module.ts export class AppModule implements NestModule { configure(consumer: MiddlewareConsumer) { consumer .apply(AuthMiddleware) // Security check .forRoutes('admin'); // Vulnerable: Path-based restriction } }
Attack Vector:
- Target Route: /admin - Middleware Path: admin - Attack Request: GET /%61dmin - Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.
Consequences:
- Authentication Bypass: Unauthenticated users can access protected routes. - Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users. - Input Validation Bypass: Middleware performing sanitization or validation can be skipped.
Patches
Patched in @nestjs/platform-fastify@11.1.11
Resources
Credit goes to Hacktron AI for reporting this issue.
Other sources
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses @nestjs/platform-fastify; relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use(); and applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in @nestjs/platform-fastify@11.1.11.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69211?
CVE-2025-69211 is categorized as a medium severity vulnerability.
How do I fix CVE-2025-69211?
To fix CVE-2025-69211, upgrade the @nestjs/platform-fastify package to version 11.1.11 or later.
What kind of applications are affected by CVE-2025-69211?
Applications using the @nestjs/platform-fastify package with NestMiddleware are affected by CVE-2025-69211.
What vulnerability does CVE-2025-69211 address?
CVE-2025-69211 addresses a Fastify URL encoding middleware bypass issue.
When was CVE-2025-69211 reported?
CVE-2025-69211 was reported in 2025, highlighting the need for urgent remediation.