CVE-2025-69211: Nestjs Nest Auth Bypass Vulnerability

CVE-2025-69211 Overview

CVE-2025-69211 is a middleware bypass vulnerability in NestJS, a framework for building scalable Node.js server-side applications. The flaw affects versions prior to 11.1.11 of @nestjs/platform-fastify and stems from inconsistent URL encoding handling between the Fastify adapter and NestJS middleware route matching. Applications relying on NestMiddleware through MiddlewareConsumer or app.use() for authentication, authorization, or input validation can be bypassed by attackers using URL-encoded path segments. The issue is patched in @nestjs/platform-fastify@11.1.11.

Critical Impact

Unauthenticated attackers can reach protected routes, lower-privileged users can access administrative endpoints, and middleware that performs sanitization or validation can be skipped entirely.

Affected Products

• NestJS @nestjs/platform-fastify versions prior to 11.1.11
• NestJS applications using MiddlewareConsumer with string paths or controller-based route binding
• NestJS applications applying middleware through app.use() to specific routes

Discovery Timeline

• 2025-12-29 - CVE-2025-69211 published to NVD
• 2026-02-20 - Last updated in NVD database

Technical Details for CVE-2025-69211

Vulnerability Analysis

NestJS supports two underlying HTTP adapters: Express and Fastify. When developers select @nestjs/platform-fastify, the route resolution path differs from Express. The framework's middleware binding layer uses one representation of the URL when matching middleware routes, while the Fastify adapter resolves the request against a different decoded form when dispatching to controllers.

This inconsistency lets an attacker craft a request whose path matches a controller handler but not the middleware route pattern. The middleware is silently skipped, and the request reaches the handler with no authentication, authorization, or sanitization checks applied. Applications that use .forRoutes('admin') or similar string-based bindings are exposed because the comparison is performed on the unnormalized URL.

The weakness maps to [CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition], reflecting that the path is evaluated once for routing and again for dispatch, with no canonicalization step in between.

Root Cause

The root cause is divergent URL decoding between Fastify's request router and NestJS's middleware route matcher. The middleware consumer compares raw path strings, while Fastify decodes percent-encoded sequences before invoking the controller. A path containing encoded characters such as %61dmin will not match the middleware pattern admin, yet Fastify normalizes the segment and routes the request to the admin controller.

Attack Vector

Exploitation requires only network access to a vulnerable endpoint. An attacker sends an HTTP request to a protected route using URL-encoded characters in the path segment guarded by middleware. The middleware layer fails to match, the request bypasses the security check, and Fastify forwards the decoded path to the protected controller. No authentication, user interaction, or special privileges are required to trigger the bypass.

No public proof-of-concept code is available. Technical details are described in the GitHub Security Advisory GHSA-8wpr-639p-ccrj.

Detection Methods for CVE-2025-69211

Indicators of Compromise

• HTTP access logs containing percent-encoded ASCII letters in path segments that correspond to protected routes, for example %61dmin, %41DMIN, or mixed-case encodings of administrative endpoints.
• Successful 2xx responses to administrative endpoints from clients that never authenticated through the expected middleware chain.
• Absence of expected middleware log entries (authentication, audit, rate-limit) for requests that reached protected controllers.

Detection Strategies

• Audit application logs for requests where the controller executed but the upstream middleware emitted no entry for the same request ID.
• Add a global interceptor or Fastify onRequest hook that logs the raw and decoded path side by side; alert when they diverge for routes bound to middleware.
• Run authenticated and unauthenticated scans against protected routes using URL-encoded path variants and compare response codes.

Monitoring Recommendations

• Forward NestJS and Fastify access logs to a centralized log platform and build queries that detect percent-encoded letters in path segments matching sensitive routes.
• Track the ratio of requests reaching admin controllers to authentication events; investigate spikes in the controller path that are not matched by auth activity.
• Monitor dependency manifests in CI for @nestjs/platform-fastify versions below 11.1.11.

How to Mitigate CVE-2025-69211

Immediate Actions Required

• Upgrade @nestjs/platform-fastify to version 11.1.11 or later across all NestJS applications using the Fastify adapter.
• Inventory every MiddlewareConsumer.forRoutes() call and every app.use() binding that targets a string path or controller; treat these as exposure points until the patch is deployed.
• Re-test authentication and authorization flows against URL-encoded variants of every protected route after upgrading.

Patch Information

The fix is delivered in @nestjs/platform-fastify@11.1.11. The upstream change is published in the NestJS patch commit c4cedda1 and described in the GitHub Security Advisory GHSA-8wpr-639p-ccrj. The patch normalizes path comparison so the middleware matcher and Fastify router agree on the decoded route.

Workarounds

• Move security checks from NestMiddleware into NestJS Guards or global interceptors, which evaluate the resolved route metadata rather than raw path strings.
• Place a reverse proxy or web application firewall in front of the application to reject requests whose path segments contain percent-encoded alphanumeric characters for known protected routes.
• Bind middleware using wildcard patterns such as * combined with in-handler authorization rather than route-string matching, until the package upgrade is complete.

# Configuration example
npm install @nestjs/platform-fastify@^11.1.11
npm ls @nestjs/platform-fastify