ETK-2026-4278Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4278",
  "cve_id": null,
  "display_id": "ETK-2026-4278",
  "ghsa_id": "GHSA-c987-fv5x-hmpg",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Route middleware authentication bypass in @nestjs/platform-fastify",
  "summary": "Affected @nestjs/platform-fastify releases can invoke a parameterized route handler without its route-bound middleware when the path parameter is empty. An unauthenticated attacker may bypass authentication or authorization checks if an application relies on MiddlewareConsumer middleware for those checks on parameterized routes.",
  "mitigation": "Upgrade @nestjs/platform-fastify to 11.2.8 or 12.1.3. Move authentication and authorization enforcement to route guards where an immediate upgrade is not possible.",
  "vendor": "npm",
  "product": "npm:@nestjs/platform-fastify",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.0.0, < 12.1.3"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "12.1.3"
      ],
      "package_name": "@nestjs/platform-fastify",
      "purl": "pkg:npm/@nestjs/platform-fastify"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 11.2.8"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "11.2.8"
      ],
      "package_name": "@nestjs/platform-fastify",
      "purl": "pkg:npm/@nestjs/platform-fastify"
    }
  ],
  "cwes": [
    288
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.33395925,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T13:53:56+00:00",
      "days": -0.4399879891550926,
      "is_lower_bound": true,
      "measured_at": "2026-11-13T00:27:31.008177+00:00",
      "url": "https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg"
    }
  }
}