Read the docs
TI-2022-13114 Aliases CVE-2022-31070GHSA-77mv-4rg7-r8qv

Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them. The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the `allowedCookies` config setting. This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Such users should update their package.json file to use `@finastra/nestjs-proxy` instead.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix Fixed finastra-nodejs-libs (Finastra): 0.7.0@finastra/nestjs-proxy (npm): 0.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Finastrafinastra-nodejs-libsbefore 0.7.00.7.0Patch availableCNA
—@finastra/nestjs-proxy (npm)before 0.7.00.7.0Patch availableGHSA-77mv-4rg7-r8qv
  • finastra-nodejs-libs VendorFinastra Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA
  • @finastra/nestjs-proxy (npm) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-77mv-4rg7-r8qv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:finastra:nestjs-proxy:*:*:*:*:*:node.js:*:*before 0.7.0VulnerableFinastra
cpe:2.3:a:nestjs-proxy_project:nestjs-proxy:*:*:*:*:*:node.js:*:*up to 0.4.0VulnerableNestjs-proxy Project
  • cpe:2.3:a:finastra:nestjs-proxy:*:*:*:*:*:node.js:*:* Versions before 0.7.0 Vulnerable ·Finastra
  • cpe:2.3:a:nestjs-proxy_project:nestjs-proxy:*:*:*:*:*:node.js:*:* Versions up to 0.4.0 Vulnerable ·Nestjs-proxy Project

Remediation

  • Fix · CNA finastra-nodejs-libs (Finastra) Fixed in 0.7.0
  • Fix · GHSA-77mv-4rg7-r8qv @finastra/nestjs-proxy (npm) Fixed in 0.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31070
  2. 2026-10-03 Alias added: GHSA-77mv-4rg7-r8qv
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 1

  • TI-2022-13113 Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences