CVE-2025-69211

Description

A NestJS application is vulnerable if it meets all of the following criteria: 1. Platform: Uses `@nestjs/platform-fastify`. 2. Security Mechanism: Relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()` 3. Routing: Applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Example Vulnerable Config: ```ts // app.module.ts export class AppModule implements NestModule { configure(consumer: MiddlewareConsumer) { consumer .apply(AuthMiddleware) // Security check .forRoutes('admin'); // Vulnerable: Path-based restriction } } ``` Attack Vector: - Target Route: `/admin` - Middleware Path: `admin` - Attack Request: `GET /%61dmin` - Result: Middleware is skipped (no match on `%61dmin`), but controller for `/admin` is executed. Consequences: - Authentication Bypass: Unauthenticated users can access protected routes. - Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users. - Input Validation Bypass: Middleware performing sanitization or validation can be skipped. ### Patches Patched in `@nestjs/[email protected]` ### Resources Credit goes to Hacktron AI for reporting this issue.

How to fix CVE-2025-69211

To remediate CVE-2025-69211, upgrade the affected package to a fixed version below.

• —upgrade to 11.1.11 or later

Is CVE-2025-69211 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 11.1.11

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-69211
• PATCHgithub.com/nestjs/nest
• WEBgithub.com/nestjs/nest/commit/c4cedda15a05aafec1e6045b36b0335ab850e771
• WEBgithub.com/nestjs/nest/security/advisories/GHSA-8wpr-639p-ccrj