npmPackage

@nestjs/platform-fastify

4 known vulnerabilities (3 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-54281High 8.7
Nest: Middleware Bypass on Fastify via Trailing Slash
Affected: fixed in 11.1.24.
Fixed in 11.1.24 (released May 25, 2026, 28 days before disclosure).
The latest release, 12.4.0, is not affected.
25% of @nestjs/platform-fastify downloads last week were affected versions (761.4K).
CVE-2026-33011High 8.7
Nest Fastify HEAD Request Middleware Bypass
Affected: fixed in 11.1.16.
Fixed in 11.1.16 (released Mar 5, 2026, 15 days before disclosure).
The latest release, 12.4.0, is not affected.
20% of @nestjs/platform-fastify downloads last week were affected versions (596.4K).
CVE-2026-2293High 8.2
NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass
Affected: fixed in 11.1.14.
Fixed in 11.1.14 (released Feb 17, 2026, 10 days before disclosure).
The latest release, 12.4.0, is not affected.
19% of @nestjs/platform-fastify downloads last week were affected versions (567.3K).
CVE-2025-69211Medium 6.9
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
Affected: fixed in 11.1.11.
Fixed in 11.1.11 (released Dec 29, 2025, the day of disclosure).
The latest release, 12.4.0, is not affected.
18% of @nestjs/platform-fastify downloads last week were affected versions (535.5K).