Interpretation Conflict in nest - #VU166179
Published: November 13, 2026
Vulnerability identifier: #VU166179
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication or authorization checks and access protected route handlers.
The vulnerability exists due to an interpretation conflict in the NestJS Fastify adapter and router when deriving paths from absolute-form request targets. A remote attacker can send a crafted request target with a query string between the authority and path to invoke a protected handler without executing its path-scoped middleware.
Affected software
nest
Remediation
Install security update from vendor's website.
nest - addressed in versions 11.2.9, 12.4.1