@nestjs/platform-fastify@10.4.22 vulnerabilities

@nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework (@platform-fastify)

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the URL encoding middleware, allowing it to be bypassed in certain configurations. An attacker can gain unauthorized access to protected routes or administrative endpoints.

To be vulnerable, an application must be applying security checks via NestMiddleware/MiddlewareConsumer or app.use(), and must apply middleware to specific routes using string paths or controllers. See the vulnerable example below.

// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // security check
      .forRoutes('admin');   // string-based rule
  }
}

Upgrade @nestjs/platform-fastify to version 11.1.11 or higher.