Improper access control in nest - CVE-2026-2293

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass middleware-based security checks.

The vulnerability exists due to improper access control in the Nest Fastify adapter middleware matching logic when handling requests with variant paths under Fastify path-normalization options. A remote attacker can send a specially crafted request to bypass middleware-based security checks.

The issue occurs because middleware matching uses a regex check over req.originalUrl while route dispatch uses Fastify-normalized paths, allowing route-scoped middleware to be skipped while the protected handler is still reached.

How to mitigate CVE-2026-2293

Sources

• https://github.com/nestjs/nest/security/advisories/GHSA-r4wm-x892-vjmx