CVE-2026-33011

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-33011 affects the Nest framework, a platform for building scalable Node.js server-side applications, specifically in versions 11.1.15 and prior when using the @nestjs/platform-fastify adapter. The vulnerability arises because Fastify automatically redirects HEAD requests to corresponding GET handlers if they exist. This redirection causes GET middleware to be entirely skipped, results in an HTTP response without a body due to truncation during the HEAD-to-GET redirect, and still executes the underlying handler. The issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and is associated with CWE-670 (Always-Incorrect Control Flow Implementation).

Attackers can exploit this vulnerability remotely over the network with no privileges or user interaction required. By sending a HEAD request to a route protected by GET middleware—such as authentication or validation checks—an attacker bypasses those middleware entirely while triggering execution of the target GET handler. This enables unauthorized access or manipulation of application logic, leading to high integrity impacts without compromising confidentiality or availability.

The NestJS security advisory (GHSA-wf42-42fg-fg84) and related GitHub resources detail the fix implemented in version 11.1.16, with a subsequent release at v11.1.17. Practitioners should upgrade to NestJS 11.1.16 or later to mitigate the issue, as evidenced by the patching commit cbdf737cd6e7cefa52d05ecea2ae4af95c464614.