SB2026040730 - Improper access control in nestjs nest

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper access control (CVE-ID: CVE-2026-2293)

The vulnerability allows a remote attacker to bypass middleware-based security checks.

The vulnerability exists due to improper access control in the Nest Fastify adapter middleware matching logic when handling requests with variant paths under Fastify path-normalization options. A remote attacker can send a specially crafted request to bypass middleware-based security checks.

The issue occurs because middleware matching uses a regex check over req.originalUrl while route dispatch uses Fastify-normalized paths, allowing route-scoped middleware to be skipped while the protected handler is still reached.

Remediation

Install update from vendor's website.

References

• https://github.com/nestjs/nest/security/advisories/GHSA-r4wm-x892-vjmx