CVE-2026-2293 is a critical flaw (CVSS 9.8) in NestJS applications that use @nestjs/platform-fastify. When Fastify path normalization options are enabled, authentication and authorization middleware can be bypassed. The record lists NestJS 11.1.13 as affected, and the v11.1.14 release carries a fix titled as a Fastify middleware bypass.
What's affected
The record says the issue affects nest.js 11.1.13. The NestJS release notes for v11.1.14, dated 17 February 2026, list a platform-fastify fix described as "fastify middleware bypass cve". That release is the fix to move to.
The condition matters. Only applications that use the Fastify platform adapter and have Fastify path normalization options enabled are described as exposed. Apps on the default Express adapter are not part of that description.
The record does not state the full range of earlier versions. If you run an older 11.x release or an earlier major version, check the NestJS repository and advisory feeds, or simply move to the current release.
How to check if you're exposed
List the installed versions, including any copies pulled in by workspaces:
npm ls @nestjs/platform-fastify @nestjs/core
Then read your Fastify bootstrap code. Look at the options passed when you create the adapter, such as settings that ignore trailing slashes, duplicate slashes or letter case in paths. If any normalization is on and your auth is implemented as middleware, take this seriously.
Finally, list which routes depend on middleware for authentication. Those are the ones that matter if the middleware is skipped.
What to do now
- Upgrade @nestjs/platform-fastify and the other NestJS packages to 11.1.14 or later, then rebuild and redeploy.
- Review your Fastify adapter options and turn off normalization you do not need.
- Where possible, enforce authentication with guards on controllers, not only with middleware, so a skipped middleware does not leave a route open.
- Test a few protected routes with unusual path forms after the upgrade to confirm they still demand credentials.
- Add the package to dependency monitoring so the next advisory reaches you quickly.
Why it matters
The record lists CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization) and CWE-863 (Incorrect Authorization). In plain terms, the framework decided which middleware applied to a request using one view of the path, and the router used another. When those two views differ, a request can reach a handler without passing through the check that was meant to guard it.
Path handling is a classic place for this. Normalization decisions such as case, slashes and encoding must happen before any security check, and the check must see the same string the router sees. The record does not mark this CVE as exploited in the wild, but an authentication bypass with a 9.8 score is a high priority for any internet facing API.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use Express with NestJS?
The record describes applications using @nestjs/platform-fastify with normalization options on, so Express setups are not the case described.
Why use guards in addition to middleware?
Guards run closer to the handler, which makes them less likely to be skipped when routing and middleware disagree about the path.
Sources
Last reviewed: 19 October 2026.
