Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nestjs/nest

              master @ fd5818c
            

Fixes

CVEs

CRITICAL

Peak severity

77.8%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

packages/platform-fastify/adapters/fastify-adapter.ts: most-fixed (4 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inconsistencies in how paths with trailing slashes, URL-encoded characters, or normalized prefixes are handled compared to the Fastify router options allow attackers to routinely bypass routing-level middleware rules.

Prototype Pollution: Untrusted request payloads containing '__proto__', 'constructor', or 'prototype' fields can manipulate object structures and bypass basic sanitization during class-transformer instantiation.

Denial of Service: Handling highly pipelined microservice payloads via recursive parsing routines triggers call-stack exhaustion crashes.