Vendors / nestjs Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 5
Exploited now nestjs records in CISA KEV No nestjs vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 69
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled.
CVSS 4.0 HIGH 8.2· Network · No auth · No interaction · EPSS 0.00764 · Published 2026-02-27 · Fixed in 11.1.14 CWE-863
Priority HIGH 66
Nest is a framework for building scalable Node.js server-side applications.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00382 · Published 2025-12-29 · Fixed in 11.1.11 CWE-367
Priority HIGH 66
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.
CVSS 3.1 MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00335 · Published 2025-03-14 · Fixed in 11.0.16, 10.4.16 CWE-94
Priority MEDIUM 44
Nest is a framework for building scalable Node.js server-side applications.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.0036 · Published 2026-03-20 · Fixed in 11.1.16 CWE-670
Priority LOW 39
Nest is a framework for building scalable Node.js server-side applications.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00329 · Published 2026-04-21 · Fixed in 11.1.19 CWE-674
Priority LOW 28
Nest is a framework for building scalable Node.js server-side applications.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00243 · Published 2026-04-07 · Partial fix · 11.1.18 CWE-74
Priority LOW 25
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00707 · Published 2023-03-06 · Fixed in 9.0.5 CWE-200
Open these records in search → All records by CVSS severity
1 5 4 0 0
THREATIST.IORead the docs