Update dependency @nestjs/platform-fastify to v11.1.14 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nestjs/platform-fastify (source)	11.1.9 → 11.1.14

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-69211

A NestJS application is vulnerable if it meets all of the following criteria:

1. Platform: Uses @nestjs/platform-fastify.
2. Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')).
   Example Vulnerable Config:

// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // Security check
      .forRoutes('admin');   // Vulnerable: Path-based restriction
  }
}

Attack Vector:

• Target Route: /admin
• Middleware Path: admin
• Attack Request: GET /%61dmin
• Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.

Consequences:

• Authentication Bypass: Unauthenticated users can access protected routes.
• Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
• Input Validation Bypass: Middleware performing sanitization or validation can be skipped.

Patches

Patched in @nestjs/platform-fastify@11.1.11

Resources

Credit goes to Hacktron AI for reporting this issue.

CVE-2026-2293

Impact

What kind of vulnerability is it? Who is impacted?

A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options (e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) are enabled. In affected route-scoped middleware setups, variant paths may skip middleware checks while still reaching the protected handler.

The bug is a path canonicalization mismatch between middleware matching and route matching in Nest’s Fastify adapter.

Nest passes Fastify routerOptions (such as ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) to the Fastify router in packages/platform-fastify/adapters/fastify-adapter.ts:253.

But middleware execution is decided by a separate regex check over req.originalUrl in packages/platform-fastify/adapters/fastify-adapter.ts:706 and packages/platform-fastify/adapters/fastify-adapter.ts:713.

If that regex does not match, Nest does next() and skips the middleware (packages/platform-fastify/adapters/fastify-adapter.ts:714), while Fastify may still normalize the same path and route it to the protected handler. So the vulnerability exists because security checks (middleware) and request dispatch(router) use different URL interpretations.

This is a fail-open design issue (inconsistent normalization), not just a bad app config: non-default router options make the mismatch reachable.

Patches

Fixed in @nestjs/platform-fastify@11.1.14

References

Credit goes to Fluidattacks (Cristian Vargas) https://fluidattacks.com/advisories/neton

---

Release Notes

nestjs/nest (@​nestjs/platform-fastify)

v11.1.14

Compare Source

v11.1.14 (2026-02-17)

Bug fixes

• platform-fastify
  • #​16384 fix(fastify): fastify middleware bypass cve (@​kamilmysliwiec)
• common
  • #​16307 fix: logger print invalid context when no stack trace provided (@​JulienDuf)

Enhancements

• common
  • #​16314 fix(common): change requestOrigin type (@​SpencerKaiser)

Committers: 5

• Julien Dufresne (@​JulienDuf)
• Kamil Mysliwiec (@​kamilmysliwiec)
• Mykhailo Skrypsky (@​mixator)
• Spencer Kaiser (@​SpencerKaiser)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.13

Compare Source

v11.1.13 (2026-02-03)

Bug fixes

• common
  • #​16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@​chojs23)

Enhancements

• microservices
  • #​16286 feat(microservices): support per-handler qos in mqtt (@​suuuuuuminnnnnn)
  • #​16262 Feat/microservices configurable max buffer size (@​jobnow)
• common
  • #​16202 fix(common): exclude built-in primitives from strip proto keys (@​som14062005)

Dependencies

• platform-fastify
  • #​16282 fix(deps): update dependency fastify to v5.7.4 (@​renovate[bot])
• platform-express
  • #​16241 fix(deps): update dependency cors to v2.8.6 (@​renovate[bot])

Committers: 6

• Lee Donghyun (@​devizi0)
• Mykhailo Skrypsky (@​mixator)
• Neo (@​chojs23)
• Praveen Somasundaram (@​som14062005)
• Ricardo Gomes (@​jobnow)
• 조수민 (@​suuuuuuminnnnnn)

v11.1.12

Compare Source

v11.1.12 (2026-01-15)

Bug fixes

• common
  • #​16187 fix(common): regression in loading file-type under Windows OS (@​iamkanguk97)

Dependencies

• platform-ws
  • #​16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@​dependabot[bot])
• common
  • #​16155 fix(deps): update dependency file-type to v21.3.0 (@​renovate[bot])
• platform-fastify
  • #​16154 fix(deps): update dependency find-my-way to v9.4.0 (@​renovate[bot])

Committers: 3

• Antonio Tripodi (@​Tony133)
• KANGUK LEE (@​iamkanguk97)
• @​miso-kyoungminkim

v11.1.11

Compare Source

v11.1.11 (2025-12-29)

Bug fixes

• platform-fastify
  • #​16135 fix(platform-fastify): middie bypassing through decoded chars (@​kamilmysliwiec)
• core
  • #​16133 fix(core): add missing catch handler for forward-ref provider resolution (@​coti-z)

Dependencies

• platform-socket.io
  • #​16125 fix(deps): update dependency socket.io to v4.8.3 (@​renovate[bot])
  • #​16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@​dependabot[bot])
• platform-fastify
  • #​16130 fix(deps): update dependency @​fastify/static to v9 (@​renovate[bot])
• common
  • #​16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@​dependabot[bot])

Committers: 3

• Himanshu Gupta (@​manureja64)
• Kamil Mysliwiec (@​kamilmysliwiec)
• coti (@​coti-z)

v11.1.10

Compare Source

v11.1.10 (2025-12-22)

Bug fixes

• core
  • #​16098 fix(core): instantiate nested transient providers in static context (@​mag123c)
  • #​16005 fix(core): resolve all providers when using resolve() with each option (@​malkovitc)
• microservices
  • #​16072 fix(microservices): fix grpc stream method return type (@​shash-hq)
• common
  • #​16077 fix(common): resolve file-type path explicitly (@​shash-hq)
  • #​16013 fix(common): Support fallbackToMimetype without buffer (@​chenjieya)

Enhancements

• common
  • #​16100 fix(common): improve error handling in FileTypeValidator (@​malkovitc)
  • #​16060 feat(common): add message property to file type validator (@​Jo-Minseok)
  • #​16079 fix: enhance ValidationPipe (@​liu-jin-yi)
• core
  • #​15721 feat(core): add Promise support for SSE handlers (@​pythonjsgo)
• microservices
  • #​15975 feat(microservices): add keepalive support for server side (@​OlegStrokan)
• common, core
  • #​15986 feat(core): add option for async logger compatibility (@​mag123c)

Dependencies

• platform-fastify
  • #​16041 fix(deps): update dependency @​fastify/cors to v11.2.0 (@​renovate[bot])
• platform-express
  • #​16002 fix(deps): update dependency express to v5.2.1 (@​renovate[bot])
• common
  • #​15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@​dependabot[bot])

Committers: 11

• Alexander (@​pythonjsgo)
• J_Coder (@​Jo-Minseok)
• Luke Son (@​KAPUIST)
• Oleh Strokan (@​OlegStrokan)
• Praveen Somasundaram (@​som14062005)
• Shashank (@​shash-hq)
• @​chenjieya
• @​giorgikakauridze
• @​mag123c
• chernomortsev evgeny (@​malkovitc)
• liu-jin-yi (@​liu-jin-yi)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.