CVE-2026-2293
Published: 27 February 2026
Summary
CVE-2026-2293 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Nestjs Nest. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2293, published on 2026-02-27, is a vulnerability in NestJS version 11.1.13 that enables bypass of authentication and authorization middleware in applications using the @nestjs/platform-fastify adapter when Fastify path-normalization options are enabled. Classified under CWE-863 (Incorrect Authorization), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread remote impact.
The vulnerability can be exploited by any unauthenticated remote attacker over the network, requiring low complexity and no user interaction. Exploitation allows bypassing middleware protections, granting unauthorized access to protected resources and enabling high-impact compromise of confidentiality, integrity, and availability within the affected NestJS application.
Mitigation is addressed in NestJS version 11.1.14, as detailed in the project's GitHub release at https://github.com/nestjs/nest/releases/tag/v11.1.14. Further technical details and recommendations are available in the Fluid Attacks advisory at https://fluidattacks.com/advisories/neton and the NestJS GitHub repository at https://github.com/nestjs/nest/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9034
Vulnerability details
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-2293 enables unauthenticated remote attackers to bypass authentication/authorization middleware in public-facing NestJS/Fastify web applications, directly facilitating T1190 (Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the NestJS Fastify adapter flaw enabling authentication and authorization bypass.
Mandates secure configuration settings for Fastify path-normalization options to prevent middleware bypass exploitation.
Enforces approved access control policies, mitigating unauthorized access resulting from the path normalization vulnerability.