CVE-2026-54281High▾ TwilightNest: Middleware Bypass on Fastify via Trailing Slash
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.
This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.
Fixed in @nestjs/[email protected]
Kudos goes to @a-tt-om
@nestjs/platform-fastify <= 11.1.23Upgrade to a patched release:
@nestjs/platform-fastify 11.1.24Connected by shared product, vendor, weakness, or advisory.
GHSA-9c5c-9qcx-q35qHigh· 7.4@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
CVE-2025-67740Low· 2.7In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
GHSA-96h4-vgxj-gvm2Medium· 6.5Nest: Unbounded memory growth in the NestJS TCP microservice transport
CVE-2026-102281High· 7.5Nest is a framework for building scalable Node.js server-side applications
CVE-2020-3578Medium· 5.3A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and ac…
CVE-2024-6593Critical· 9.1Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained netwo…