The bug allows an unauthenticated client to bypass authentication middleware in Nest applications that use the Fastify adapter by simply adding a trailing slash to the request URL. This results in a full authentication bypass for the protected route, giving attackers the ability to execute actions that should require valid credentials, thereby compromising confidentiality, integrity, and availability of the system. The weakness is an improper access control flaw and is identified as CWE-863.

The vulnerability affects the Nest framework, specifically the @nestjs/platform-fastify package, on all versions prior to 11.1.24. Any application that registers middleware through NestJS's MiddlewareConsumer.forRoutes() API while running a Fastify adapter without additional path checks is susceptible.

The CVSS score of 8.7 indicates a high severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending a request with a trailing slash to a protected endpoint, bypassing authentication without needing any credentials. This short and straightforward attack path makes it likely that the vulnerability will be leveraged by remote threat actors.