CVE-2026-33011

CVE-2026-33011 describes a high-severity middleware bypass vulnerability affecting NestJS applications utilizing @nestjs/platform-fastify GET middleware in versions 11.1.15 and below. This flaw allows an attacker to bypass security controls by sending a HEAD request, which Fastify automatically redirects to the GET handler, executing the handler without middleware processing and potentially leading to high integrity impact. Rated 7.5 HIGH, the vulnerability has a network attack vector, low complexity, requires no privileges or user interaction, and impacts data integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this issue. Organizations should upgrade to NestJS version 11.1.16 or higher to remediate this risk.