CVE-2026-2293CRITICAL 9.8EPSS p48.3%

CVE-2026-2293CVE-2026-2293

nestjs / nest

Description

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.67% probability of exploitation · percentile 48.3% · 2026-08-03T12:00:16Z
Published2026-02-27
Last modified2026-07-15

Underlying weaknesses· 1

CWE-863

References

  1. https://fluidattacks.com/advisories/neton
  2. https://github.com/nestjs/nest/
  3. https://github.com/nestjs/nest/releases/tag/v11.1.14

1

TypeTargetConfidenceTier
WeaknessIncorrect Authorizationcwe-8630%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-2880
CVE
CVE-2026-22037
CVE
CVE-2026-33808
CVE
CVE-2026-6270
CVE
CVE-2025-11366
CVE
CVE-2025-29927
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.