VYPR
Get started
← All advisories
High severityNVD Advisory· Published Mar 20, 2026· Updated Mar 20, 2026

Nest Fastify HEAD Request Middleware Bypass

CVE-2026-33011

Description

Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: middleware will be completely skipped, the HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler), and the actual handler will still be executed. This issue is fixed in version 11.1.16.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@nestjs/platform-fastifynpm
< 11.1.1611.1.16

Affected products

1

Patches

1
cbdf737cd6e7

feat(core): auto run get middleware for head requests

https://github.com/nestjs/nestKamil MyśliwiecMar 16, 2026via ghsa
commit
2 files changed · +33 −1
  • integration/hello-world/e2e/middleware-fastify.spec.ts+27 −0 modified
    @@ -765,5 +765,32 @@ describe('Middleware (FastifyAdapter)', () => {
         await app.close();
       });
     });
+
+    describe('HEAD auto-forwarding to GET', () => {
+      beforeEach(async () => {
+        app = (
+          await Test.createTestingModule({
+            imports: [TestModule],
+          }).compile()
+        ).createNestApplication<NestFastifyApplication>(new FastifyAdapter());
+
+        await app.init();
+      });
+
+      it(`GET forRoutes(HEAD /abc/def)`, () => {
+        return app
+          .inject({
+            method: 'HEAD',
+            url: '/abc/def',
+          })
+          .then(({ payload }) =>
+            expect(payload).to.be.eql(MIDDLEWARE_RETURN_VALUE),
+          );
+      });
+
+      afterEach(async () => {
+        await app.close();
+      });
+    });
   });
 });
  • packages/core/middleware/middleware-module.ts+6 −1 modified
    @@ -335,7 +335,12 @@ export class MiddlewareModule<
           res: TResponse,
           next: () => void,
         ) => {
-          if (applicationRef.getRequestMethod?.(req) === requestMethod) {
+          const actualRequestMethod = applicationRef.getRequestMethod?.(req);
+          if (
+            actualRequestMethod === requestMethod ||
+            (actualRequestMethod === RequestMethod[RequestMethod.HEAD] &&
+              requestMethod === RequestMethod[RequestMethod.GET])
+          ) {
             return proxy(req, res, next);
           }
           return next();

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.