TI-2026-29535 CVE-2026-40879 · GHSA-hpwf-8g29-85qm
Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
Priority LOW 39
Nest is a framework for building scalable Node.js server-side applications.
Vulnerabilities
7 records
TI-2026-27632 CVE-2026-35515 · GHSA-36xv-jgw5-4q75
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Priority LOW 28
Nest is a framework for building scalable Node.js server-side applications.
TI-2026-25458 CVE-2026-33011 · GHSA-wf42-42fg-fg84
Nest Fastify HEAD Request Middleware Bypass
Priority MEDIUM 44
Nest is a framework for building scalable Node.js server-side applications.
TI-2026-01938 CVE-2026-2293 · GHSA-r4wm-x892-vjmx
NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass
Priority HIGH 69
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled.
TI-2025-42665 CVE-2025-69211 · GHSA-8wpr-639p-ccrj
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
Priority HIGH 66
Nest is a framework for building scalable Node.js server-side applications.
TI-2024-19449 CVE-2024-29409 · GHSA-cj7v-w2c7-cp7c
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute…
Priority HIGH 66
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.
TI-2023-11333 CVE-2023-26108 · GHSA-4jpv-8r57-pv7j
Information disclosure in @nestjs/core
Priority LOW 25
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe.