CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

org.webjars.npm:nestjs__platform-express (>=8.4.7 <=9.0.0-next.2) potentially affected by CVE-2025-47944 via org.webjars.npm:multer (=1.4.4-lts.1)

org.webjars.npm:multer MAVEN version =1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2025-47944 Source advisory:...

org.webjars.npm:nestjs__platform-express (>=8.4.7 <=9.0.0-next.2) potentially affected by CVE-2025-47935 via org.webjars.npm:multer (=1.4.4-lts.1)

org.webjars.npm:multer MAVEN version =1.4.4-lts.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:multer and may be impacted: - org.webjars.npm:nestjsplatform-express =8.4.7, =9.0.0-next.2 Source cves: CVE-2025-47935 Source advisory:...

MAL-2025-4011 Malicious code in nestjs-translator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0ceb5fa1318b74c2003c389bed9724f792a9755ee095548718c1aaead2bbaaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nestjs-translator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0ceb5fa1318b74c2003c389bed9724f792a9755ee095548718c1aaead2bbaaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-29409

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header...

nest allows a remote attacker to execute arbitrary code via the Content-Type header

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header...

@akanjs/nest (>=0.0.4 <=0.0.16), @akanjs/server (>=0.0.4 <=0.0.16) +323 more potentially affected by CVE-2024-29409 via @nestjs/common (>=10.0.0 <=10.4.15)

@nestjs/common NPM version =10.0.0, =0.0.4, =0.0.4, =1.1.5, =10.0.0, =10.2.2, =1.0.0, =0.0.67, =0.0.56, =1.0.1-dev.17, =0.399.0, =2.2.7-bb.3, =4.38.0, =5.9.13 and more Source cves: CVE-2024-29409 Source advisory: OSV:GHSA-CJ7V-W2C7-CP7C...

GHSA-CJ7V-W2C7-CP7C nest allows a remote attacker to execute arbitrary code via the Content-Type header

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header...

CVE-2024-29409

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header...

@boxyhq/saml-jackson (>=1.3.2 <=1.11.1), @boxyhq/saml20 (>=1.0.11 <=1.2.3) +4 more potentially affected by CVE-2025-29775 via xml-crypto (>=3.0.0 <=3.2.0)

xml-crypto NPM version =3.0.0, =1.3.2, =1.0.11, =1.13.3, =1.13.5, =2.1.0, =1.0.0, =1.0.1 Source cves: CVE-2025-29775 Source advisory: OSV:GHSA-X3M8-899R-F7C3...

@boxyhq/saml-jackson (>=1.3.2 <=1.11.1), @boxyhq/saml20 (>=1.0.11 <=1.2.3) +4 more potentially affected by CVE-2025-29774 via xml-crypto (>=3.0.0 <=3.2.0)

xml-crypto NPM version =3.0.0, =1.3.2, =1.0.11, =1.13.3, =1.13.5, =2.1.0, =1.0.0, =1.0.1 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...

CVE-2024-29409

CVE-2024-29409 : The IBM NOI bulletin confirms a file-upload vulnerability in NestJS Nest v10.3.2 where arbitrary code execution is possible via the Content-Type header, i.e., a remote attacker can exploit a crafted upload request that abuses Content-Type handling. The document does not provide r...

CVE-2024-29409

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header...

CVE-2024-29409

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header...

CVE-2024-29409

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header...

@ai-em/opentelemetry-nestjs (=5.0.0), @amplication/opentelemetry-nestjs (>=1.0.0 <=4.2.1) +258 more potentially affected by unknown CVE via @opentelemetry/instrumentation (>=0.40.0 <=0.41.1)

@opentelemetry/instrumentation NPM version =0.40.0, =1.0.0, =1.0.14, =1.0.20, =3.0.1, =0.0.0-2023-07-27--11-15, =0.0.1, =0.0.0-alpha.20230501.1, =1.0.0-alpha.20230614.2, =0.1.2, =1.0.0, =2.3.95, =1.0.2-beta.0, =1.0.2-beta.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F8PQ-3926-8GX...

Information Exposure

@nestjs/common, is vulnerable to information exposure. The vulnerability exists due to a lack of client request sanitization in the streamable-file.ts file, allowing an attacker to read sensitive information in the system through the DVI element...

CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

Open redirect

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...