6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69211

CVE-2025-69211: Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses @nestjs/platform-fastify; relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use(); and applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in @nestjs/platform-fastify@11.1.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69211

CVE-2025-69211:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nestjs/platform-fastify	npm	< 11.1.10	11.1.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-check Time-of-use (TOCTOU) issue caused by inconsistent URL decoding between the NestJS middleware layer and the underlying Fastify router. The root cause is that the middleware matching logic did not decode URL-encoded characters in the request path before checking if a middleware should be applied.

An attacker could send a request with a URL-encoded path, such as /%61dmin.

Time-of-check: The middleware dispatcher (originally in @fastify/middie, and also in FastifyAdapter.use) would compare the path pattern (e.g., /admin) against the raw path (/%61dmin). The match would fail, and the security middleware (e.g., for authentication/authorization) would be skipped.
Time-of-use: The request would then be passed to the Fastify router, which would decode the path to /admin. The router would find the corresponding controller for /admin and execute it, but without the security checks from the skipped middleware.

The patch addresses this by introducing URL decoding at the point of the middleware path check. The commit c4cedda15a05aafec1e6045b36b0335ab850e771 implements two main fixes:

It replaces the external @fastify/middie package with a patched, internal version (packages/platform-fastify/adapters/middie/fastify-middie.ts). Inside this new file, the runMiddie function and its internal logic now use safeDecodeURI on the request URL before performing the regex match to determine if a middleware should run.
It also modifies FastifyAdapter.use to decode the pathname using safeDecodeURI for middleware applied directly with app.use().

The identified vulnerable functions, FastifyAdapter.use and the logic now within runMiddie, were the points where the vulnerable 'check' occurred.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.