CVE-2025-69211: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69211 is a Fastify URL encoding middleware bypass vulnerability (TOCTOU) in the NestJS framework's @nestjs/platform-fastify package. It affects all versions of @nestjs/platform-fastify prior to 11.1.11 and was disclosed on December 29, 2025, by Hacktron AI and published via the GitHub Security Advisory GHSA-8wpr-639p-ccrj. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, NestJS Advisory).

The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw (CWE-367) in how the Fastify adapter's middleware routing layer handles URL-encoded characters. When NestJS middleware is applied to specific routes via MiddlewareConsumer.forRoutes('admin') or app.use(), the middleware matching logic checks the raw (encoded) URL path, while Fastify's router decodes the URL before dispatching to the controller. An attacker can send a request with percent-encoded characters in the path (e.g., GET /%61dmin instead of GET /admin), causing the middleware check to fail to match the route (no security enforcement), while the controller still receives and processes the decoded /admin request. The fix, committed in c4cedda, addresses middie bypassing through decoded characters in the Fastify adapter (NestJS Advisory, Patch Commit).

Successful exploitation allows unauthenticated users to access routes protected by NestJS middleware, restricted administrative endpoints to become accessible to lower-privileged users, and input sanitization or validation middleware to be completely bypassed. The confidentiality and integrity impacts are rated High, as attackers can read sensitive data and perform unauthorized actions on protected resources. Availability is not directly impacted, but the ability to bypass authentication and authorization controls can enable further lateral movement or data exfiltration within the application (Github Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is referenced in the NestJS security advisory on GitHub, though there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.029% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory, NestJS Advisory).

1. Reconnaissance: Identify NestJS applications using @nestjs/platform-fastify (versions < 11.1.11) that expose protected routes via middleware (e.g., /admin, /api/internal). This can be done by inspecting HTTP response headers (e.g., x-powered-by: fastify) or reviewing publicly available source code.
2. Identify protected routes: Probe the application to discover routes that return 401/403 when accessed normally, indicating middleware-enforced access controls (e.g., GET /admin returns 401 Unauthorized).
3. Craft URL-encoded bypass request: Percent-encode one or more characters in the protected path segment. For example, encode the first character of admin as %61, resulting in the path /%61dmin. Other characters can similarly be encoded (e.g., /adm%69n).
4. Send bypass request: Issue the crafted HTTP request to the target server: GET /%61dmin HTTP/1.1. The middleware routing layer fails to match %61dmin against the configured route admin, so the security middleware is skipped.
5. Access protected resource: Fastify decodes the URL before routing to the controller, so the controller for /admin is invoked without any authentication or authorization checks having been performed, granting the attacker unauthorized access to the protected endpoint (NestJS Advisory, Patch Commit).

• Network: HTTP requests to protected routes (e.g., /admin, /api/internal) containing percent-encoded characters in the path (e.g., /%61dmin, /adm%69n, /admin%2F); requests that return 200 OK on encoded paths that normally return 401/403 on the decoded equivalent.
• Logs: Web/application access logs showing requests with URL-encoded path segments to sensitive endpoints without corresponding authentication tokens or session cookies; absence of middleware execution log entries for requests that successfully reached protected controllers.
• Application Behavior: Successful responses (HTTP 200) to requests on administrative or restricted endpoints from unauthenticated or low-privileged users, particularly where the request URL contains percent-encoded characters (NestJS Advisory).

The vulnerability is patched in @nestjs/platform-fastify@11.1.11. All users of @nestjs/platform-fastify versions prior to 11.1.11 should upgrade immediately. As a temporary workaround prior to patching, consider moving security checks (authentication, authorization) into Fastify guards or interceptors rather than relying solely on path-based NestMiddleware, or implement URL normalization/decoding before middleware route matching. After upgrading, review access logs for any suspicious encoded-path requests to protected endpoints (NestJS Advisory, Patch Commit).

The vulnerability was reported by Hacktron AI and disclosed by NestJS maintainer kamilmysliwiec via the GitHub Security Advisory on December 29, 2025. Red Hat tracked the issue via Bugzilla (Bug 2425826) with a high severity rating. Coverage appeared on security blogs including SystemTek and InfinitSec shortly after disclosure, and the CVE was discussed on Bluesky by automated CVE tracking accounts (Red Hat Bugzilla, NestJS Advisory).