GHSA-9c5c-9qcx-q35q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

• npm @nestjs/platform-fastify: < 11.2.4 → fixed in 11.2.4 • npm @nestjs/platform-fastify: >= 12.0.0, < 12.0.2 → fixed in 12.0.2

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/platform-fastify` | | Affected versions | `>= 12.0.0, res.end('blocked by auth middleware')) .forRoutes({ path: 'users', method: RequestMethod.GET }); } } ``` `supertest` and `light-my-request` always emit origin-form targets, so the request has to be written to the socket: ```js const { connect } = require('node:net'); const socket = connect(3000, '127.0.0.1', () => { socket.write( 'GET http://127.0.0.1:3000/users HTTP/1.1\r\n' + 'Host: 127.0.0.1:3000\r\n' + 'Connection: close\r\n\r\n', ); }); socket.pipe(process.stdout); ``` Observed on an affected version: `protected data` — the middleware did not run. Expected, and observed on a patched version: `blocked by auth middleware`. Patches Fixed in 12.0.2 and 11.2.4. Upgrading to 12.0.3 or 11.2.5 is recommended. • The bundled `@fastify/middie` fork was removed and the package now depends on `@fastify/[email protected]`, which resolves absolute-form targets before matching. • The adapter resolves absolute-form targets in its own route check, mirroring `find-my-way`. • Deprecated top-level Fastify router options are folded into `routerOptions` so the middleware engine and the router normalize paths identically. Workarounds If you cannot upgrade, reject non-origin-form request targets before middleware runs. Register the hook on the Fastify instance before the application is initialized, so that it runs ahead of the middleware engine's own `onRequest` hook, and confirm with the request above that the rejection takes effect: ```ts const adapter = new FastifyAdapter(); adapter.getInstance().addHook('onRequest', (request, reply, done) => { const target = request.raw.url ?? ''; // "*" is the legitimate request target of "OPTIONS * HTTP/1.1" if (target[0] !== '/' && target !== '*') { reply.code(400).send(); return; } done(); }); ``` Rejecting or normalizing absolute-form targets at a reverse proxy in front of the application is equally effective. Credit Reported by ZeroVuln Labs.