Interpretation Conflict Affecting @nestjs/platform-fastify package, versions <11.2.4>=12.0.0 <12.0.2
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NESTJSPLATFORMFASTIFY-20510282
- published5 Oct 2026
- disclosed30 Sept 2026
- creditUnknown
Introduced: 30 Sep 2026
New CVE NOT AVAILABLE CWE-288 (opens in a new tab)How to fix?
Upgrade @nestjs/platform-fastify to version 11.2.4, 12.0.2 or higher.
Overview
@nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework (@platform-fastify)
Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using an absolute-form request target (e.g., GET http://host/path), Fastify routes the request to the handler while path-scoped middleware - which matches against the raw request target - never runs. An attacker can send requests using absolute-form targets to bypass any middleware-enforced security controls such as authentication, authorization, or rate limiting.