{"action":"Upgrade @nestjs/platform-fastify to 11.2.4 or later.","affected":[{"fixed":"11.2.4","introduced":"0"},{"fixed":"12.0.2","introduced":"12.0.0"}],"component":"@nestjs/platform-fastify","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["11.2.4","12.0.2"],"ghsa_id":"GHSA-9c5c-9qcx-q35q","id":"tcs_01M5KFFFY00VBXHGC2MFAN8099","modified_at":"2026-09-30T15:00:05.347048398Z","published_at":"2026-09-30T14:41:39Z","references":["https://osv.dev/vulnerability/GHSA-9c5c-9qcx-q35q","https://github.com/fastify/middie/security/advisories/GHSA-hx87-8wv7-pjv8","https://github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q","https://github.com/nestjs/nest/pull/17737","https://github.com/nestjs/nest/commit/5226fe084cf64b357de436f154bc89f2d319b621","https://github.com/nestjs/nest/commit/dda252090ecb65009d9ff366444303796fc44fd7","https://github.com/nestjs/nest","https://github.com/nestjs/nest/releases/tag/v11.2.4","https://github.com/nestjs/nest/releases/tag/v12.0.2"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-9c5c-9qcx-q35q","url":"https://osv.dev/vulnerability/GHSA-9c5c-9qcx-q35q"}],"summary":"@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets"}