CVE-2026-2293

CriticalPublic PoC

Published: 27 February 2026

Published

27 February 2026

Modified

14 April 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0043 62.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2293 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Nestjs Nest. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires identification, reporting, and correction of the NestJS Fastify adapter flaw enabling authentication and authorization bypass.

CM-6 Configuration Settings good match

prevent

Mandates secure configuration settings for Fastify path-normalization options to prevent middleware bypass exploitation.

AC-3 Access Enforcement partial match

prevent

Enforces approved access control policies, mitigating unauthorized access resulting from the path normalization vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2026-2293 enables unauthenticated remote attackers to bypass authentication/authorization middleware in public-facing NestJS/Fastify web applications, directly facilitating T1190 (Exploit Public-Facing Application).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

Deeper analysisAI

CVE-2026-2293, published on 2026-02-27, is a vulnerability in NestJS version 11.1.13 that enables bypass of authentication and authorization middleware in applications using the @nestjs/platform-fastify adapter when Fastify path-normalization options are enabled. Classified under CWE-863 (Incorrect Authorization), it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread remote impact.

The vulnerability can be exploited by any unauthenticated remote attacker over the network, requiring low complexity and no user interaction. Exploitation allows bypassing middleware protections, granting unauthorized access to protected resources and enabling high-impact compromise of confidentiality, integrity, and availability within the affected NestJS application.

Mitigation is addressed in NestJS version 11.1.14, as detailed in the project's GitHub release at https://github.com/nestjs/nest/releases/tag/v11.1.14. Further technical details and recommendations are available in the Fluid Attacks advisory at https://fluidattacks.com/advisories/neton and the NestJS GitHub repository at https://github.com/nestjs/nest/.