⬆️ Update dependency @nestjs/platform-fastify to v11.1.11 [SECURITY] by renovate[bot] · Pull Request #3038 · ViewTube/viewtube

renovate · 2025-12-30T17:41:58Z

This PR contains the following updates:

Package	Change	Age	Confidence
@nestjs/platform-fastify (source)	`11.1.3` → `11.1.11`

GitHub Vulnerability Alerts

CVE-2025-69211

A NestJS application is vulnerable if it meets all of the following criteria:

Platform: Uses @nestjs/platform-fastify.
Security Mechanism: Relies on NestMiddleware (via MiddlewareConsumer) for security checks (authentication, authorization, etc.), or through app.use()
Routing: Applies middleware to specific routes using string paths or controllers (e.g., .forRoutes('admin')).
Example Vulnerable Config:

// app.module.ts
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(AuthMiddleware) // Security check
      .forRoutes('admin');   // Vulnerable: Path-based restriction
  }
}

Attack Vector:

Target Route: /admin
Middleware Path: admin
Attack Request: GET /%61dmin
Result: Middleware is skipped (no match on %61dmin), but controller for /admin is executed.

Consequences:

Authentication Bypass: Unauthenticated users can access protected routes.
Authorization Bypass: Restricted administrative endpoints become accessible to lower-privileged users.
Input Validation Bypass: Middleware performing sanitization or validation can be skipped.

Patches

Patched in @nestjs/platform-fastify@11.1.11

Resources

Credit goes to Hacktron AI for reporting this issue.

Release Notes

nestjs/nest (@nestjs/platform-fastify)

`v11.1.11`

Compare Source

v11.1.11 (2025-12-29)

Bug fixes

platform-fastify
- #16135 fix(platform-fastify): middie bypassing through decoded chars (@kamilmysliwiec)
core
- #16133 fix(core): add missing catch handler for forward-ref provider resolution (@coti-z)

Dependencies

platform-socket.io
- #16125 fix(deps): update dependency socket.io to v4.8.3 (@renovate[bot])
- #16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@dependabot[bot])
platform-fastify
- #16130 fix(deps): update dependency @fastify/static to v9 (@renovate[bot])
common
- #16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@dependabot[bot])

Committers: 3

Himanshu Gupta (@manureja64)
Kamil Mysliwiec (@kamilmysliwiec)
coti (@coti-z)

`v11.1.10`

Compare Source

v11.1.10 (2025-12-22)

Bug fixes

core
- #16098 fix(core): instantiate nested transient providers in static context (@mag123c)
- #16005 fix(core): resolve all providers when using resolve() with each option (@malkovitc)
microservices
- #16072 fix(microservices): fix grpc stream method return type (@shash-hq)
common
- #16077 fix(common): resolve file-type path explicitly (@shash-hq)
- #16013 fix(common): Support fallbackToMimetype without buffer (@chenjieya)

Enhancements

common
- #16100 fix(common): improve error handling in FileTypeValidator (@malkovitc)
- #16060 feat(common): add message property to file type validator (@Jo-Minseok)
- #16079 fix: enhance ValidationPipe (@liu-jin-yi)
core
- #15721 feat(core): add Promise support for SSE handlers (@pythonjsgo)
microservices
- #15975 feat(microservices): add keepalive support for server side (@OlegStrokan)
common, core
- #15986 feat(core): add option for async logger compatibility (@mag123c)

Dependencies

platform-fastify
- #16041 fix(deps): update dependency @fastify/cors to v11.2.0 (@renovate[bot])
platform-express
- #16002 fix(deps): update dependency express to v5.2.1 (@renovate[bot])
common
- #15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@dependabot[bot])

Committers: 11

Alexander (@pythonjsgo)
J_Coder (@Jo-Minseok)
Luke Son (@KAPUIST)
Oleh Strokan (@OlegStrokan)
Praveen Somasundaram (@som14062005)
Shashank (@shash-hq)
@chenjieya
@giorgikakauridze
@mag123c
chernomortsev evgeny (@malkovitc)
liu-jin-yi (@liu-jin-yi)

`v11.1.9`

Compare Source

v11.1.9 (2025-11-14)

Bug fixes

core
- #15865 fix(core): make get() throw for implicitly request-scoped trees (@JoeNutt)

Enhancements

common
- #15863 feat(common): add method options to @sse decorator (@TomerSteinberg)

Dependencies

platform-fastify
- #15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@dependabot[bot])

Committers: 4

Rami (@JoeNutt)
Rhynel Algopera (@dev-rhynel)
Tomer Steinberg (@TomerSteinberg)
WuMingDao (@WuMingDao)

`v11.1.8`

Compare Source

v11.1.8 (2025-10-27)

Bug fixes

core
- #15815 fix(core): ensure nested transient provider isolation (@mag123c)
platform-fastify
- #15831 fix(fastify): Migrate fastify top-level options to routerOptions (@kim-sung-jee)

Committers: 2

JaeHo Jang (@mag123c)
Seongjee Kim (@kim-sung-jee)

`v11.1.7`

Compare Source

v11.1.7 (2025-10-21)

Bug fixes

microservices
- #15747 Fix/rmq microservice fanout bind (@slon2015)
platform-fastify
- #15732 fix: correct parameter type in RouteConstraints decorator (@thedv91)
core
- #15571 fix(core): skip lifecycle hooks for non-instantiated transient services (@mag123c)
common
- #15577 Add color allowance check to console logger options (@kerryChen95)

Enhancements

common, platform-socket.io, websockets
- #15543 feat(websockets): allow manual acknowledgement handling with @Ack() decorator (@kim-sung-jee)
common
- #15705 fix(core): resolve extras in configurable module builder async methods (@mag123c)
common, core
- #15503 feat(common): add force-console option to console logger (@mag123c)
core
- #15588 fix(core): improve dependency resolution error messages (@at7211)
microservices
- #15598 feat(errors): add InvalidTcpDataReceptionException for handling TCP receive errors (@ghyghoo8)

Dependencies

platform-fastify
- #15664 chore(deps): bump fastify to 5.6.1 (@dependabot[bot])
core, platform-express, platform-fastify
- #15622 fix(deps): update dependency path-to-regexp to v8.3.0 (@renovate[bot])
common
- #15566 chore(deps): bump load-esm from 1.0.2 to 1.0.3 (@dependabot[bot])

Committers: 9

Harry (@thedv91)
JaeHo Jang (@mag123c)
Jay-Chou (@at7211)
Kerry (@kerryChen95)
Micael Levi L. Cavalcante (@micalevisk)
Seongjee Kim (@kim-sung-jee)
SerafimGerasimov (@slon2015)
@Olexandr88
ghy (@ghyghoo8)

`v11.1.6`

Compare Source

v11.1.6 (2025-08-07)

Bug fixes

core
- #15504 fix(core): fix race condition in class dependency resolution from imported modules (@hajekjiri)
- #15469 fix(core): attach root inquirer for nested transient providers (@kamilmysliwiec)
microservices
- #15508 fix(microservices): report correct buffer length in exception (@kim-sung-jee)
- #15492 fix(microservices): fix kafka serilization of class instances (@LeonBiersch)

Dependencies

platform-fastify
- #15493 chore(deps): bump @fastify/cors from 11.0.1 to 11.1.0 (@dependabot[bot])

Committers: 6

Jiri Hajek (@hajekjiri)
Kamil Mysliwiec (@kamilmysliwiec)
Leon Biersch (@LeonBiersch)
Seongjee Kim (@kim-sung-jee)
@premierbell
pTr (@ptrgits)

`v11.1.5`

Compare Source

v11.1.5 (2025-07-18)

Dependencies

platform-express
- #15425 chore(deps): bump multer from 2.0.1 to 2.0.2 in /packages/platform-express (@dependabot[bot])

`v11.1.4`

Compare Source

v11.1.4 (2025-07-16)

Bug fixes

platform-fastify
- #15385 fix(testing): auto-init fastify adapter for middleware registration (@mag123c)
core, testing
- #15405 fix(core): fix race condition in class dependency resolution (@hajekjiri)
core
- #15333 fix(core): Make flattenRoutePath return a valid module (@gentunian)
microservices
- #15305 fix(microservices): Revisit RMQ pattern matching with wildcards (@getlarge)
- #15250 fix(constants): update RMQ_DEFAULT_QUEUE to an empty string (@EeeasyCode)

Enhancements

platform-fastify
- #14789 feat(fastify): add decorator for custom schema (@piotrfrankowski)
common, core, microservices, platform-express, platform-fastify, websockets
- #15386 feat: enhance introspection capabilities (@kamilmysliwiec)
core
- #15374 feat: supporting fine async storage control (@Farenheith)

Dependencies

platform-ws
- #15350 chore(deps): bump ws from 8.18.2 to 8.18.3 (@dependabot[bot])
platform-fastify
- #15278 chore(deps): bump fastify from 5.3.3 to 5.4.0 (@dependabot[bot])

Committers: 11

Alexey Filippov (@SocketSomeone)
EFIcats (@ext4cats)
Edouard Maleix (@getlarge)
JaeHo Jang (@mag123c)
Jiri Hajek (@hajekjiri)
Kamil Mysliwiec (@kamilmysliwiec)
Khan / 이창민 (@EeeasyCode)
Peter F. (@piotrfrankowski)
Sebastian (@gentunian)
Thiago Oliveira Santos (@Farenheith)
jochong (@jochongs)

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Zurich, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot added the dependencies Pull requests that update a dependency file label Dec 30, 2025

renovate bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch 2 times, most recently from 336a467 to 36aef5d Compare January 23, 2026 19:32

⬆️ Update dependency @nestjs/platform-fastify to v11.1.11 [SECURITY]

72b797b

renovate bot force-pushed the renovate/npm-nestjs-platform-fastify-vulnerability branch from 36aef5d to 72b797b Compare February 2, 2026 19:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

⬆️ Update dependency @nestjs/platform-fastify to v11.1.11 [SECURITY]#3038

⬆️ Update dependency @nestjs/platform-fastify to v11.1.11 [SECURITY]#3038
renovate[bot] wants to merge 1 commit intodevelopmentfrom
renovate/npm-nestjs-platform-fastify-vulnerability

renovate bot commented Dec 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate bot commented Dec 30, 2025

GitHub Vulnerability Alerts

Patches

Resources

Release Notes

v11.1.11 (2025-12-29)

Bug fixes

Dependencies

Committers: 3

v11.1.10 (2025-12-22)

Bug fixes

Enhancements

Dependencies

Committers: 11

v11.1.9 (2025-11-14)

Bug fixes

Enhancements

Dependencies

Committers: 4

v11.1.8 (2025-10-27)

Bug fixes

Committers: 2

v11.1.7 (2025-10-21)

Bug fixes

Enhancements

Dependencies

Committers: 9

v11.1.6 (2025-08-07)

Bug fixes

Dependencies

Committers: 6

v11.1.5 (2025-07-18)

Dependencies

v11.1.4 (2025-07-16)

Bug fixes

Enhancements

Dependencies

Committers: 11

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants