CVE-2026-33011

Description

### Impact In a NestJS application using `@nestjs/platform-fastify`, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: - Middleware will be completely skipped. - The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler). - The actual handler will still be executed. ### Patches Fixed in `@nestjs/[email protected]`

Affected packages (1)

• npm/@nestjs/platform-fastifyfrom 0, < 11.1.16

CVSS scores

References (5)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-33011
• PATCHhttps://github.com/nestjs/nest
• WEBhttps://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614
• WEBhttps://github.com/nestjs/nest/releases/tag/v11.1.17
• WEBhttps://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84