CVE-2026-33011
HIGH
Always-Incorrect Control Flow Implementation (CWE-670)
GHSA-wf42-42fg-fg84
7.5
CVSS 3.1 · GitHub Advisory
Share
Severity by source
GitHub Advisory
PRIMARY
7.5
HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Lifecycle Timeline
3
Analysis Generated
Mar 17, 2026 - 20:30 vuln.today
Patch released
Mar 17, 2026 - 20:30 nvd
Patch available
CVE Published
Mar 17, 2026 - 18:38 nvd
HIGH 7.5
Blast Radius
ecosystem impact
— you monitor
† from your stack dependencies
† transitive graph · vuln.today resolves 4-path depth
- 2 npm packages depend on @nestjs/platform-fastify (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 11.1.16.
DescriptionGitHub Advisory
Impact
In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).
As a result:
- Middleware will be completely skipped.
- The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
- The actual handler will still be executed.
Patches
Fixed in @nestjs/platform-fastify@11.1.16
AnalysisAI
CVE-2026-33011 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Technical ContextAI
Vulnerability type not specified by vendor. CVSS 7.5 indicates high severity.
RemediationAI
Apply the vendor-supplied patch immediately.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).