Read the docs
TI-2022-13113 Aliases CVE-2022-31069GHSA-j562-c3cw-3p5g

Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the `forwardToken` config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix Fixed finastra-nodejs-libs (Finastra): 0.7.0@finastra/nestjs-proxy (npm): 0.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finastrafinastra-nodejs-libsbefore 0.7.00.7.0Patch availableCNA
—@finastra/nestjs-proxy (npm)before 0.7.00.7.0Patch availableGHSA-j562-c3cw-3p5g
  • finastra-nodejs-libs VendorFinastra Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA
  • @finastra/nestjs-proxy (npm) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-j562-c3cw-3p5g

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:finastra:nestjs-proxy:*:*:*:*:*:node.js:*:*before 0.7.0VulnerableFinastra
cpe:2.3:a:nestjs-proxy_project:nestjs-proxy:*:*:*:*:*:node.js:*:*up to 0.4.0VulnerableNestjs-proxy Project
  • cpe:2.3:a:finastra:nestjs-proxy:*:*:*:*:*:node.js:*:* Versions before 0.7.0 Vulnerable ·Finastra
  • cpe:2.3:a:nestjs-proxy_project:nestjs-proxy:*:*:*:*:*:node.js:*:* Versions up to 0.4.0 Vulnerable ·Nestjs-proxy Project

Remediation

  • Fix · CNA finastra-nodejs-libs (Finastra) Fixed in 0.7.0
  • Fix · GHSA-j562-c3cw-3p5g @finastra/nestjs-proxy (npm) Fixed in 0.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31069
  2. 2026-10-03 Alias added: GHSA-j562-c3cw-3p5g
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 1

  • TI-2022-13114 Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences