GitHub Advisoryadvisory · npm
GHSA-wf42-42fg-fg84 Nest Fastify HEAD Request Middleware Bypass
HIGH
Official page ↗
- Aliases
- CVE-2026-33011
- Ecosystem
- npm
- Packages
- @nestjs/platform-fastify
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-670
- Reviewed
- 2026-03-17
Affected packages
• npm @nestjs/platform-fastify: < 11.1.16 → fixed in 11.1.16
Description
Impact
In a NestJS application using `@nestjs/platform-fastify`, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).
As a result:
• Middleware will be completely skipped.
• The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
• The actual handler will still be executed.
Patches
Fixed in `@nestjs/[email protected]`
Related
Alias · CVE (1)
- CVE-2026-33011 Nest is a framework for building scalable Node.js server-side applications. vulnerability
Weakness · CWE (1)
- CWE-670 Always-Incorrect Control Flow Implementation weakness
References
- https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-33011 advisory
- https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614 web
- https://github.com/nestjs/nest package
- https://github.com/nestjs/nest/releases/tag/v11.1.17 web