CVE-2026-54281 json
Nest: Middleware Bypass on Fastify via Trailing Slash
published 5mo ago modified 17d ago also EUVD-2026-38398 , GHSA-6v32-fjc9-9qf6
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL. This bypass works on the default Fastify adapter configuration. This vulnerability is fixed in 11.1.24.
Patch / fix
- npm @nestjs/platform-fastify 11.1.24
- nestjs nest 11.1.24
Is CVE-2026-54281 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @nestjs/platform-fastify | <11.1.24 |
11.1.24 |
Affected products
- nestjs nest
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-54281
advisory
-
github.com
/nestjs/nest
package
Sources
- CVE List CVE-2026-54281
- GitHub Advisory GHSA-6v32-fjc9-9qf6
- NVD CVE-2026-54281
- Maintainer advisory GHSA-6v32-fjc9-9qf6
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of nestjs/nest published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.