Incorrect authorization in nest - CVE-2026-54281
Published: June 12, 2026
Vulnerability identifier: #VU134473
CSH Severity: Medium
CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2026-54281
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper access control in MiddlewareConsumer.forRoutes() middleware handling in the Fastify adapter when handling requests with a trailing slash appended to the URL. A remote attacker can send a specially crafted request to bypass authentication.
This affects applications using the standard CRUD route shape when those routes are protected with MiddlewareConsumer.forRoutes() middleware on the default Fastify adapter configuration.
Affected software
nest
How to mitigate CVE-2026-54281
Install security update from vendor's website.
nest - update to 11.1.24