CVE-2026-2293
Published: 27 February 2026
Description
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the NestJS Fastify adapter flaw enabling authentication and authorization bypass.
Mandates secure configuration settings for Fastify path-normalization options to prevent middleware bypass exploitation.
Enforces approved access control policies, mitigating unauthorized access resulting from the path normalization vulnerability.
Security SummaryAI
CVE-2026-2293, published on 2026-02-27, is a vulnerability in NestJS version 11.1.13 that enables bypass of authentication and authorization middleware in applications using the @nestjs/platform-fastify adapter when Fastify path-normalization options are enabled. Classified under CWE-863 (Incorrect Authorization), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread remote impact.
The vulnerability can be exploited by any unauthenticated remote attacker over the network, requiring low complexity and no user interaction. Exploitation allows bypassing middleware protections, granting unauthorized access to protected resources and enabling high-impact compromise of confidentiality, integrity, and availability within the affected NestJS application.
Mitigation is addressed in NestJS version 11.1.14, as detailed in the project's GitHub release at https://github.com/nestjs/nest/releases/tag/v11.1.14. Further technical details and recommendations are available in the Fluid Attacks advisory at https://fluidattacks.com/advisories/neton and the NestJS GitHub repository at https://github.com/nestjs/nest/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-2293 enables unauthenticated remote attackers to bypass authentication/authorization middleware in public-facing NestJS/Fastify web applications, directly facilitating T1190 (Exploit Public-Facing Application).