Interpretation Conflict in nest - #VU166178

Vulnerability details

The vulnerability allows a remote attacker to bypass middleware-based authentication and authorization checks and access or modify protected data.

The vulnerability exists due to an interpretation conflict between Fastify routing and Nest middleware path matching in @nestjs/platform-fastify when processing empty route parameters. A remote attacker can send a request with an empty route parameter to execute a protected route handler without running middleware bound through MiddlewareConsumer.forRoutes(...).

Affected software

Remediation

External References

• https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg

Related Security Bulletins

• Multiple vulnerabilities in nest