CVE-2025-69211
HighSummary
Nest to framework do budowania skalowalnych aplikacji serwerowych w Node.js. Wersje przed 11.1.11 mają lukę w middleware kodowania URL Fastify, co pozwala na ominięcie zabezpieczeń w aplikacjach NestJS, które korzystają z `@nestjs/platform-fastify` oraz `NestMiddleware` dla kontroli bezpieczeństwa.
Risk Assessment
Wykorzystanie tej luki może prowadzić do sytuacji, w której nieautoryzowani użytkownicy uzyskują dostęp do chronionych tras, a ograniczone punkty administracyjne stają się dostępne dla użytkowników o niższych uprawnieniach.
Recommendation
Zaleca się aktualizację do wersji `@nestjs/[email protected]` w celu załatania tej luki oraz przegląd konfiguracji middleware w aplikacjach korzystających z NestJS.
Related vulnerabilities
- CVE-2026-90817Critical
An unauthenticated Remote Code Execution vulnerability was found in REDCap 13.3.0 and higher in the survey passthrough routing and Data Import processing logic. An attacker can manipulate HTTP requests to access an unintended controller route from a public survey context and supply a crafted file-path/stream parameter during import handling. Exploitation requires knowledge of a valid public survey hash.
- CVE-2026-94003Critical
A stack-based buffer overflow vulnerability was found in Comfast CF-N1-S 2.6.0.1 in the get_css_path_from_uri function of /cgi-bin/mbox-config in the Web Management Interface. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.
- CVE-2026-94084Critical
Use-after-free vulnerability in Suricata before 8.0.7 occurs in the Http2ThreadMultiBuf mechanism when a transaction is inspected by rules using http.response_header with and without a transform.
- CVE-2026-94083Critical
In Suricata before 8.0.7, a type confusion in DoH2 can cause an invalid free because cleanup code for HTTP2 state runs even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is default in 8.x versions.
- CVE-2026-93958Critical
Vulnerability in D-Link R95 (BE9500_1.00.16) affects the system function in /bin/ssi of the DHMAPI component. Manipulation of the NTPServer argument results in OS command injection. The attack can be executed remotely, and the exploit is public.
- CVE-2026-93985Critical
OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
- CVE-2026-78030Critical
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. These attributes are passed to require without checking that the value names a module, allowing loading and executing code from any file.
- CVE-2026-93742Critical
A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.
- CVE-2026-86591Critical
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
- CVE-2026-93741Critical
A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.
Original NVD description (English source)
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/[email protected]`.