CVE-2026-2293 NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass
Attackers can bypass authentication and authorization middleware in NestJS applications using Fastify if path normalization is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2293?
CVE-2026-2293 is a high-severity authentication bypass vulnerability in nest.js, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled.
This issue affects nest.Js: 11.1.13.
Which versions are affected by CVE-2026-2293?
2 open source packages ship an affected version, including @nestjs/platform-fastify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nestjs/platform-fastify npm | All versions | 11.1.14 |
@nestjs/platform-fastify npm | All versions | 11.1.14 |
Products include Nestjs Nest.
How do I fix CVE-2026-2293?
Upgrade @nestjs/platform-fastify to 11.1.14 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-2293 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2293 exists.
Other vulnerabilities in nest.js
- CVE-2026-33011 Nest Fastify HEAD Request Middleware Bypass
- CVE-2026-40879 Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
- CVE-2025-69211 Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
- CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
- CVE-2024-29409 nest allows a remote attacker to execute arbitrary code via the Content-Type header
Sources
Also known as GHSA-r4wm-x892-vjmx.