GHSA-wf42-42fg-fg84High
Nest Fastify HEAD Request Middleware Bypass
🔗 CVE IDs covered (1)
📋 Description
Impact
In a NestJS application using @nestjs/platform-fastify, GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist).
As a result:
- Middleware will be completely skipped.
- The HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler).
- The actual handler will still be executed.
Patches
Fixed in @nestjs/[email protected]
🎯 Affected products1
- npm/@nestjs/platform-fastify:<= 11.1.15