The flaw arises when a NestJS application uses the @nestjs/platform-fastify package with Fastify's path‑normalisation options turned on. The framework fails to invoke its validation pipeline before executing authentication and authorization middleware, allowing crafted HTTP requests to bypass those checks. This defect corresponds to identity management weaknesses (CWE‑551) and authorization bypass (CWE‑863). An attacker can therefore reach endpoints or resources that should be protected, exposing data or enabling actions that the user is not permitted to perform.

Any Node.js deployment of NestJS 11.1.13 that imports @nestjs/platform-fastify is affected. The vulnerability applies to applications running on Linux, macOS, or Windows where Fastify path‑normalisation is enabled. Users deploying the open‑source NestJS framework must ensure they are not using this specific release with the default configuration.

With a CVSS score of 8.2, the vulnerability is high severity. The EPSS score is below 1 %, indicating a low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. Nevertheless, the attack path is simple: an adversary can send specially crafted HTTP requests to a publicly reachable NestJS instance, which will be processed without the normal authentication and authorization checks. No special privileges or network access beyond the ability to reach the target server are required.