{"id":"CVE-2025-69211","aliases":["GHSA-8wpr-639p-ccrj"],"url":"https://o3.security/vulnerability/CVE-2025-69211","summary":"Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)","details":"A NestJS application is vulnerable if it meets all of the following criteria:\n\n1. Platform: Uses `@nestjs/platform-fastify`.\n2. Security Mechanism: Relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`\n3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`).\nExample Vulnerable Config:\n\n```ts\n// app.module.ts\nexport class AppModule implements NestModule {\n  configure(consumer: MiddlewareConsumer) {\n    consumer\n      .apply(AuthMiddleware) // Security check\n      .forRoutes('admin');   // Vulnerable: Path-based restriction\n  }\n}\n```\n\nAttack Vector:\n\n- Target Route: `/admin`\n- Middleware Path: `admin`\n- Attack Request: `GET /%61dmin`\n- Result: Middleware is skipped (no match on `%61dmin`), but controller for `/admin` is executed.\n\nConsequences:\n\n- Authentication Bypass: Unauthenticated users can access protected routes.\n- Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.\n- Input Validation Bypass: Middleware performing sanitization or validation can be skipped.\n\n### Patches\n\nPatched in `@nestjs/platform-fastify@11.1.11`\n\n### Resources\n\nCredit goes to Hacktron AI for reporting this issue.","published":"2025-12-29T16:01:22.801Z","modified":"2026-10-28T02:30:38.638832006Z","cvss":null,"epss":{"score":0.00369,"percentile":0.29639,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@nestjs/platform-fastify","fixedVersion":"11.1.11"}],"fix":{"url":"https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771","label":"nestjs/nest@c4cedda"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69211.json"},{"type":"ADVISORY","url":"https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69211"},{"type":"FIX","url":"https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771"},{"type":"PACKAGE","url":"https://github.com/nestjs/nest"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:38.638832006Z"}}