GHSA-wf42-42fg-fg84High

Nest Fastify HEAD Request Middleware Bypass

Published
March 17, 2026
Last Modified
March 20, 2026

🔗 CVE IDs covered (1)

📋 Description

Impact

In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).

As a result:

  • Middleware will be completely skipped.
  • The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
  • The actual handler will still be executed.

Patches

Fixed in @nestjs/[email protected]

🎯 Affected products1

  • npm/@nestjs/platform-fastify:<= 11.1.15

🔗 References (5)