CVE-2025-69211

Executive Summary

CVE-2025-69211 is a critical security bypass vulnerability in the NestJS framework, specifically affecting applications using the @nestjs/platform-fastify adapter. The flaw resides in how Fastify URL encoding is handled, allowing an attacker to bypass middleware-based security checks (authentication, authorization, sanitization) when middleware is applied to specific routes using string paths or controllers (e.g., .forRoutes('admin')). This can lead to unauthenticated access to protected routes, privilege escalation, and bypassing of input validation. The vulnerability is patched in version 11.1.11 of @nestjs/platform-fastify.

Supply Chain & Package Security

This vulnerability is in the @nestjs/platform-fastify npm package. Organizations using NestJS with Fastify must verify their dependency tree and ensure they are not relying on a vulnerable version. The supply chain risk is high because the package is widely used in Node.js server-side applications. Immediate action is required to update to the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD has not yet assigned a score)
• Threat Level: Critical (based on the nature of the bypass and potential impact)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability exploits a discrepancy in how Fastify handles URL encoding compared to NestJS's middleware routing logic. When a middleware is applied to a specific route (e.g., admin), NestJS uses a string comparison or pattern matching to determine if the middleware should execute. However, Fastify may decode or normalize the URL differently, allowing an attacker to craft a request that bypasses the middleware's route matching.

For example, if middleware is applied to .forRoutes('admin'), an attacker could send a request to /admin (with a double slash) or use URL encoding tricks like /%61dmin (where %61 is 'a'). The middleware might not match these variations, but Fastify would still route the request to the admin controller, effectively bypassing the security check.

Vulnerable vs. Patched Code

Vulnerable Code (pre-11.1.11):

// In a vulnerable NestJS application
import { Module, MiddlewareConsumer } from '@nestjs/common';
import { AuthMiddleware } from './auth.middleware';

@Module({})
export class AppModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware)
      .forRoutes('admin'); // Vulnerable: string path matching
  }
}

Patched Code (11.1.11+):

// The fix involves normalizing URL paths before matching
// The exact patch is in the @nestjs/platform-fastify package
// It ensures that URL encoding is handled consistently
// between the middleware matching and the Fastify router.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable NestJS application using @nestjs/platform-fastify@11.0.0 with a middleware protecting the /admin route.
2. Exploit: Send a request to http://target.com//admin (double slash) or http://target.com/%61dmin (URL-encoded 'a').
3. Observation: The middleware is bypassed, and the attacker gains access to the admin functionality without authentication.

Example cURL command:

curl -v "http://target.com//admin"

Blue Team

1. Detection: Monitor for unusual URL patterns, especially double slashes (//) and URL-encoded characters in paths that are supposed to be protected.
2. Mitigation: Immediately upgrade to @nestjs/platform-fastify@11.1.11 or later.
3. Workaround: If immediate patching is not possible, implement a custom middleware that normalizes the URL path before any other middleware runs.

Indicators of Compromise (IOCs)

• Network: HTTP requests to protected routes with double slashes (e.g., //admin) or URL-encoded characters (e.g., /%61dmin).
• Logs: Access logs showing successful requests to protected routes without prior authentication.
• Application: Unexpected behavior in middleware that should have blocked certain routes.

Detection Engineering

YARA Rule

rule CVE_2025_69211_NestJS_Fastify_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2025-69211 NestJS Fastify URL encoding bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69211"
    strings:
        $s1 = "//" ascii
        $s2 = /%[0-9a-fA-F]{2}/ ascii
    condition:
        any of ($s1, $s2) and #s2 > 3
}

Sigma Rule

title: CVE-2025-69211 NestJS Fastify URL Encoding Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-69211
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-query|contains:
            - '//'
            - '%61'
            - '%2f'
    condition: selection
falsepositives:
    - Legitimate use of double slashes in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69211 NestJS Fastify URL Encoding Bypass"; flow:to_server,established; content:"//"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade @nestjs/platform-fastify to version 11.1.11 or later.
2. Verification: Run npm audit or yarn audit to confirm the vulnerable package is no longer in the dependency tree.
3. Workaround: If immediate patching is not possible, implement a custom middleware that normalizes the URL path (e.g., remove double slashes, decode URL-encoded characters) before any other middleware runs.
4. Monitoring: Enable logging for all middleware actions and monitor for unusual URL patterns.
5. Testing: After patching, test all protected routes to ensure the bypass is no longer possible.

Valters IT
DevSecOps & Cyber Threat Intelligence