AIKIDO-2026-742982

TL;DR

@nestjs/platform-fastify matches path-scoped Nest middleware against the raw request target, while the Fastify router resolves that target to a path before dispatching. A request written in absolute form, such as GET http://host/path instead of GET /path, therefore reaches the route handler while middleware bound to that path never runs, so authentication, authorization, rate limiting, or any other guard attached to specific routes is silently skipped. The fix replaces the stale bundled @fastify/middie fork with the upstream package, resolves absolute-form targets before middleware matching, and aligns router options between the router and the middleware engine.