CVE-2026-2293
NestJS 11.1.13 (fixed 11.1.14)
- Class
- Auth bypass
- Severity
- High · CVSS 4.0 score 8.2
- Disclosed
- Credit
- Cristian Vargas, Fluid Attacks Offensive Team
- Code name
- neton
- Affected
- NestJS 11.1.13 (fixed 11.1.14)
The defect
Auth/authz bypass via path normalization (lack of data validation)
Class overview · Auth bypass
A request reaches a protected handler without passing the check that guards it. In normalization bugs the security check and the router interpret the same URL differently, and the check fails open.
Hunt demo · local simulation
Two matching passes over one URL, exactly as described in the advisory. Everything runs in your browser; nothing is sent anywhere.
| Request path | Expected (advisory neton) |
|---|---|
/secret | 401 |
/secret/ | 200 |
//secret | 200 |
/secret;foo=bar | 200 |
- Middleware gate (regex over originalUrl)
- RUNS · auth enforced · literal match against /secret
- Fastify router (after normalization)
- normalized path: /secret · MATCH · /secret → AppController.getSecret
401 · blocked — the middleware ran and rejected the request