CVE-2026-2293: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2293 is a Fastify URL Encoding Middleware Bypass vulnerability in NestJS that allows unauthenticated attackers to circumvent authentication and authorization middleware by exploiting path-normalization options in the @nestjs/platform-fastify adapter. It affects NestJS version 11.1.13 and earlier (specifically the @nestjs/platform-fastify package up to and including v11.1.13). The vulnerability was discovered by Cristian Vargas of Fluid Attacks, published on February 27, 2026, and patched in v11.1.14 released February 17, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.2 (High) (Github Advisory, Feedly).

The root cause is a path canonicalization mismatch (CWE-863: Incorrect Authorization) between NestJS's middleware matching logic and Fastify's route dispatch logic. When Fastify router options such as ignoreTrailingSlash, ignoreDuplicateSlashes, or useSemicolonDelimiter are enabled, Fastify normalizes incoming request paths before routing — but NestJS middleware matching uses a separate regex check against req.originalUrl (in packages/platform-fastify/adapters/fastify-adapter.ts at lines 706 and 713). If the regex does not match the variant path, NestJS calls next() and skips the middleware entirely (line 714), while Fastify still normalizes and routes the request to the protected handler. This fail-open design means an attacker can craft a URL variant (e.g., with a trailing slash, duplicate slashes, or semicolons) that bypasses middleware checks while still reaching the protected route handler (Github Advisory, Fluid Attacks Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass any route-scoped middleware, including authentication and authorization guards, in NestJS applications using the Fastify adapter with non-default path-normalization options enabled. This can result in unauthorized access to protected API endpoints, exposure of confidential data, unauthorized modification of application data, and potentially denial of service. The integrity impact is rated High under CVSS v4.0, reflecting the risk of unauthorized data modification through unprotected handlers (Github Advisory, Feedly).

A proof-of-concept exploit is publicly available via Fluid Attacks' advisory at fluidattacks.com/advisories/neton, added to NVD exploit references on April 13, 2026. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.43% (63rd percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. Exploitation requires that the target application has non-default Fastify path-normalization options enabled, which limits the attack surface to a subset of NestJS/Fastify deployments (Github Advisory, Fluid Attacks Advisory).

1. Reconnaissance: Identify NestJS applications using @nestjs/platform-fastify version 11.1.13 or earlier. Look for API endpoints protected by route-scoped middleware (e.g., authentication guards). Determine whether the application has Fastify path-normalization options enabled (ignoreTrailingSlash, ignoreDuplicateSlashes, or useSemicolonDelimiter).
2. Identify protected routes: Map the application's API surface to find routes that require authentication or authorization middleware (e.g., /api/admin, /api/user/profile).
3. Craft variant URL: Construct a URL variant that Fastify will normalize to the protected route but that NestJS's middleware regex will not match. Examples include:
   • Adding a trailing slash: /api/admin/ instead of /api/admin
   • Using duplicate slashes: /api//admin
   • Appending a semicolon delimiter: /api/admin;param
4. Send crafted request: Issue an HTTP request to the variant URL without authentication credentials. NestJS's middleware regex fails to match the variant path and calls next(), skipping the authentication middleware.
5. Access protected handler: Fastify normalizes the variant URL to the canonical protected route and dispatches the request to the handler, granting the attacker unauthenticated access to the protected resource (Github Advisory, Fluid Attacks Advisory).

• Network: HTTP requests to protected API endpoints using URL variants with trailing slashes, duplicate slashes, or semicolon delimiters (e.g., /api/admin/, /api//admin, /api/admin;x) without authentication headers or tokens; unexpected successful responses (2xx) to such requests from unauthenticated clients.
• Logs: Application access logs showing requests to variant paths (e.g., paths with //, trailing /, or ;) that return successful responses to unauthenticated clients; absence of middleware execution logs (e.g., auth guard logs) for requests that nonetheless reach protected handlers.
• Application Behavior: Unexpected access to privileged API functionality without valid session tokens or credentials; audit logs showing data reads or modifications attributed to anonymous or unauthenticated sessions.

Upgrade @nestjs/platform-fastify to version 11.1.14 or later, which contains the fix for this vulnerability (commit fd8d073) (NestJS Release). As a workaround for organizations unable to upgrade immediately, disable Fastify path-normalization options (ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter) in the Fastify adapter configuration if they are not explicitly required for application functionality. Additionally, consider implementing authentication checks at the route handler level (e.g., using NestJS Guards) rather than relying solely on route-scoped middleware, as a defense-in-depth measure (Github Advisory, Feedly).

The vulnerability was credited to Cristian Vargas of Fluid Attacks, who published a detailed advisory. The NestJS maintainer Kamil Myśliwiec (kamilmysliwiec) promptly addressed the issue with a fix in v11.1.14, labeled in the release notes as fix(fastify): fastify middleware bypass cve. The GitHub Advisory received 19 positive reactions from the community, indicating notable attention. The CVE was also tracked by ENISA under EUVD-2026-9034 (NestJS Release, Github Advisory).