CVE-2026-2293: Nestjs Nest

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

Affected products

• Nestjs Nest: version 11.1.13 only

Published 2026-02-27. Last modified 2026-07-15.