The vulnerability arises from Fastify's automatic conversion of HEAD requests to GET handlers in NestJS applications that use @nestjs/platform-fastify GET middleware. When a HEAD request is received for an endpoint that has a corresponding GET handler, Fastify redirects the request to that handler. As a result, any GET‑specific middleware—such as authentication, logging, or rate limiting—is bypassed, the response body is omitted because the HEAD response is truncated, and the original GET handler executes as if the request were a normal GET. This behavior is captured by CWE‑670, which denotes a violation of intended authorization or flow control.

Affected systems are NestJS applications built with the @nestjs/platform-fastify package running version 11.1.15 or earlier. The impact applies to the NestJS framework core library, which is typically deployed in Node.js runtime environments. Versions 11.1.16 and later contain the fix and are not affected.

The CVSS base score is 8.7, indicating high severity, while the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation probability. The most likely exploitation path involves an attacker sending a simple HEAD request to a publicly reachable NestJS endpoint that implements a GET handler, causing the middleware chain to be skipped and handler logic to run without the intended safeguards. Because the missing middleware can include authorization checks, the potential impact extends to unauthorized execution of the handler logic, as inferred from the description of the bypass.