CVE-2026-33011
highpriority · track · 30EPSS 0.005 · 41 %ileEUUSEPSS · scored 2026-10-24
Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: middleware will be completely skipped, the HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler), and the actual handler will still be executed. This issue is fixed in version 11.1.16.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-wf42-42fg-fg84Nest Fastify HEAD Request Middleware Bypass2026-03-17ghsa · osvUS
### Impact In a NestJS application using `@nestjs/platform-fastify`, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: - Middleware will be completely skipped. - The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler). - The actual handler will still be executed. ### Patches Fixed in `@nestjs/platform-fastify@11.1.16`
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614cnnvd
- https://github.com/nestjs/nest/releasesPatchcnnvd
- https://github.com/nestjs/nest/releases/tag/v11.1.17cnnvd
- https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84cnnvd
- https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614enisa_euvd
- https://github.com/nestjs/nest/releases/tag/v11.1.17enisa_euvd
- https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84enisa_euvd
- https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614Patchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan