[GHSA-8wpr-639p-ccrj] Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

[nikpivkin]

Updates

• Affected products
• CVSS v4
• Severity

Comments
The range should be < 11.1.11, not < 11.1.10. The advisory text says "Patched in @nestjs/platform-fastify@11.1.11".

The fix nestjs/nest@c4cedda is in tag v11.1.11 and not in tag v11.1.10.

So version 11.1.10 is still vulnerable but is outside the current range.

The form does not accept the E:U metric in the CVSS 4.0 vector (see #5357), so I had to remove it. Please keep E:U if possible, I did not mean to change the severity.

[github]

Hi there @kamilmysliwiec! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[nikpivkin]

The severity change from MODERATE to CRITICAL is not intended. The form does not accept E:U in the CVSS 4.0 vector (#5357), so I had to remove it, and the score went up. Please keep the original vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U and severity MODERATE. The only change I meant is the range.

[Copilot]

Copilot review overview

🟡 Changes recommended

The valid E:U metric and corresponding moderate severity must be restored.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Restore removed CVSS v4 E:U metric · New

What changed in this PR

Updates the NestJS Fastify advisory’s affected range and severity metadata.

Changes:

• Removes the stale < 11.1.10 range override, leaving 11.1.11 as the fix.
• Removes CVSS E:U and changes severity to critical; both are unintended.

File	Description
GHSA-8wpr-639p-ccrj.json	Updates affected-version and severity metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nikpivkin]

Suggested change

	"severity": "CRITICAL",
	"severity": "MODERATE",