CVE-2025-69211 (CNNVD-202512-4959)
中文标题:
nest 安全漏洞
英文标题:
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
漏洞描述
中文描述:
nest是nestjs开源的一个 Node.js 框架，用于使用 TypeScript/JavaScript 构建高效、可扩展和企业级的服务器端应用程序。 nest 11.1.11之前版本存在安全漏洞，该漏洞源于Fastify URL编码中间件存在绕过，可能导致未经验证的用户访问受保护路由。
英文描述:
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `MiddlewareConsumer`) for security checks (authentication, authorization, etc.), or through `app.use()`; and applies middleware to specific routes using string paths or controllers (e.g., `.forRoutes('admin')`). Exploitation can result in unauthenticated users accessing protected routes, restricted administrative endpoints becoming accessible to lower-privileged users, and/or middleware performing sanitization or validation being skipped. This issue is patched in `@nestjs/platform-fastify@11.1.11`.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| nestjs | nest | < 11.1.11 | - | - |
cpe:2.3:a:nestjs:nest:<_11.1.11:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-69211 |
2025-12-30 04:11:40 | 2026-01-12 02:12:33 |
| NVD | nvd_CVE-2025-69211 |
2026-01-01 04:27:48 | 2026-01-12 02:28:15 |
| CNNVD | cnnvd_CNNVD-202512-4959 |
2026-01-11 06:15:03 | 2026-01-12 02:38:08 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202512-4959
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']