Authentication bypass via encoded path mismatch

Authentication bypass in Nest before 11.1.11 allows remote attackers to reach middleware-protected routes via encoded URL paths. Fastify evaluates an encoded path such as /%61dmin against Nest middleware before routing decodes it to /admin, so the middleware misses while the controller matches. Exposure requires @nestjs/platform-fastify and security or validation middleware scoped by string paths or controllers; bypassed checks permit unauthorized reads or state-changing actions available at the target route.