SB2026111326 - Interpretation Conflict in nest

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111326

SB2026111326 - Interpretation Conflict in nest

Published: November 13, 2026

Security Bulletin ID SB2026111326
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication or authorization checks and access protected route handlers.

The vulnerability exists due to an interpretation conflict in the NestJS Fastify adapter and router when deriving paths from absolute-form request targets. A remote attacker can send a crafted request target with a query string between the authority and path to invoke a protected handler without executing its path-scoped middleware.


Remediation

Install update from vendor's website.

References