Vulnerability · Published Dec 29, 2025 · Assigned by GitHub_M

CVE-2025-69211Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

Medium 6.9

In plain English

A medium-severity security flaw in nest from nestjs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 67.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nestjs/platform-fastify	11.1.11	GHSA-8wpr-639p-ccrj

Affected products (as reported)

Vendor	Product	Versions
nestjs	nest	< 11.1.11

Weakness: CWE-367 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References

https://github.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj x_refsource_CONFIRM
https://github.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771 x_refsource_MISC