NestJS CVE-2025-69211

Exploitable only when ALL of the following hold: (1) the application uses @nestjs/platform-fastify (the Fastify adapter, not the default Express adapter); (2) it enforces a security check (authentication/authorization/validation) in a NestMiddleware wired through MiddlewareConsumer, or via app.use(); and (3) that middleware is bound to specific routes using string paths or controllers, e.g. .forRoutes('admin'), rather than being applied globally. Attacker supplies a percent-encoded variant of a character in the path (GET /%61dmin for /admin) so the middleware's literal path match misses while the Fastify router still resolves to the real controller. LIMITING factors: applications on the default Express platform are not affected; middleware applied globally (not path/controller-scoped) is not bypassed; and only versions prior to 11.1.11 are vulnerable. No authentication or user interaction is required for the request itself (PR:N/UI:N).

This is a genuine but conditional access-control flaw rather than a blanket critical issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) indicates a remote, unauthenticated attack with no user interaction, but the AT:P flag (attack requirements present) correctly signals that exploitation depends on a specific, non-default application configuration - not every NestJS deployment is affected. The score of 6.9 (Medium) is consistent with high confidentiality and integrity impact offset by that configuration dependency. The exploit maturity in the vector is E:U (unproven/unreported at the time the vector was authored), yet the intelligence feed marks POC as publicly available because the GHSA advisory itself publishes a working attack request (GET /%61dmin); these two signals conflict, so treat this as 'publicly available exploit code exists' per the advisory rather than relying on the stale E:U metric. No EPSS score was provided and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation - absence of KEV combined with a published, trivially reproducible technique means risk is driven by how easy the bug is to weaponize, not by confirmed in-the-wild use. CWE-367 (TOCTOU) accurately captures the root cause: middleware path matching and the router decode URL-encoding at different times. Net: real priority for teams running the vulnerable Fastify-plus-path-based-middleware pattern, lower priority for the Express-default majority.

An application uses @nestjs/platform-fastify and protects its /admin routes by applying an authentication NestMiddleware via .forRoutes('admin'). An unauthenticated attacker sends GET /%61dmin: the middleware's string match fails against the encoded path so the auth check is skipped, but Fastify's router decodes the path and dispatches to the real /admin controller, granting access. A working proof-of-concept request is published directly in the GHSA-8wpr-639p-ccrj advisory.