CVE-2025-69211

CVE-2025-69211 is a high-severity Fastify URL encoding middleware bypass vulnerability affecting NestJS applications using @nestjs/platform-fastify versions prior to 11.1.11. This flaw allows unauthenticated or lower-privileged users to bypass security checks implemented via NestMiddleware or app.use() when applied to specific routes, potentially leading to unauthorized access to protected or administrative endpoints. With a CVSS score of 7.4 (HIGH), the vulnerability has a network attack vector and high impact on confidentiality and integrity, but requires high attack complexity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.