Vulnerabilities

TI-2026-65315 CVE-2026-102281 · GHSA-m8vh-jmq9-5rjg

Nest: Remote process termination via a deeply nested microservice message pattern

HIGH 72

Nest is a framework for building scalable Node.js server-side applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00586 Published 2026-09-28 Fixed in 11.2.4, 12.0.2 CWE-248

TI-2026-39181 CVE-2026-54281 · GHSA-6v32-fjc9-9qf6

Nest: Middleware Bypass on Fastify via Trailing Slash

MEDIUM 40

Nest is a framework for building scalable Node.js server-side applications.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00498 Published 2026-06-22 Fixed in 11.1.24 CWE-863

TI-2026-29535 CVE-2026-40879 · GHSA-hpwf-8g29-85qm

Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)

LOW 39

Nest is a framework for building scalable Node.js server-side applications.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00329 Published 2026-04-21 Fixed in 11.1.19 CWE-674

TI-2026-27632 CVE-2026-35515 · GHSA-36xv-jgw5-4q75

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

LOW 28

Nest is a framework for building scalable Node.js server-side applications.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00243 Published 2026-04-07 Partial fix · 11.1.18 CWE-74

TI-2026-25458 CVE-2026-33011 · GHSA-wf42-42fg-fg84

Nest Fastify HEAD Request Middleware Bypass

MEDIUM 44

Nest is a framework for building scalable Node.js server-side applications.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0036 Published 2026-03-20 Fixed in 11.1.16 CWE-670

TI-2026-01938 CVE-2026-2293 · GHSA-r4wm-x892-vjmx

NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass

HIGH 69

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00764 Published 2026-02-27 Fixed in 11.1.14 CWE-863

TI-2025-42665 CVE-2025-69211 · GHSA-8wpr-639p-ccrj

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

HIGH 66

Nest is a framework for building scalable Node.js server-side applications.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00382 Published 2025-12-29 Fixed in 11.1.11 CWE-367

TI-2025-34537 CVE-2025-54782 · GHSA-85cg-cmq5-qjm7

@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

HIGH 76

Nest is a framework for building scalable Node.js server-side applications.

CVSS 4.0CRITICAL 9.4 Adjacent network No auth No interaction EPSS 0.47188 Published 2025-08-01 Fixed in 0.2.1 CWE-352

TI-2024-19449 CVE-2024-29409 · GHSA-cj7v-w2c7-cp7c

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute…

HIGH 66

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00335 Published 2025-03-14 Fixed in 11.0.16, 10.4.16 CWE-94

TI-2023-11333 CVE-2023-26108 · GHSA-4jpv-8r57-pv7j

Information disclosure in @nestjs/core

LOW 25

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00707 Published 2023-03-06 Fixed in 9.0.5 CWE-200

Vulnerabilities

Filters