CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

CVE-2023-26108

CVE-2023-26108 affects the NestJS framework component @nestjs/core when running versions prior to 9.0.5 . The vulnerability enables information exposure via the StreamableFile pipe if a client cancels a request while streaming; the underlying stream remains open, potentially leaking data. Connect...

PT-2023-20495 · Nestjs · @Nestjs/Core

Name of the Vulnerable Software and Affected Versions: @nestjs/core versions prior to 9.0.5 Description: The issue allows for Information Exposure via the StreamableFile pipe. This can be exploited when a client cancels a request while streaming a StreamableFile, resulting in the stream wrapped b...

nestjs 安全漏洞

nestjs is nestjs' progressive Node.js framework for building efficient, scalable, and enterprise-class server-side applications on top of TypeScript and JavaScript. A security vulnerability exists in versions of nestjs prior to 9.0.5 that stems from exposing information through the StreamableFile...

@falkor/falkor-auth-server (=1.1.1), @figedi/sentry-fastify (=1.0.6) +6 more potentially affected by CVE-2022-41919 via fastify (>=4.0.2 <=4.10.0)

fastify NPM version =4.0.2, =0.0.2, =0.0.16 - verdaccio =6.0.0-6-next.52 Source cves: CVE-2022-41919 Source advisory: OSV:GHSA-3FJJ-P79J-C9HH...

MAL-2022-3210 Malicious code in freekws-devportal-api-client-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6844a713c19484257db4a41fa914be2ee9dd774feb1dcec5698ce8fdb776066f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in freekws-devportal-api-client-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6844a713c19484257db4a41fa914be2ee9dd774feb1dcec5698ce8fdb776066f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nestjs-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 712dfba5f6483ec5b01dbe91ce2b407887542d9cc9588955146a3970ec6097fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4802 Malicious code in nestjs-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 712dfba5f6483ec5b01dbe91ce2b407887542d9cc9588955146a3970ec6097fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nestjs-ldap-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65363e22ae6934a381048355dec14bb6b668cfc1d21b311be5ed9d15cd12bf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4801 Malicious code in nestjs-ldap-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65363e22ae6934a381048355dec14bb6b668cfc1d21b311be5ed9d15cd12bf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy

The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to...

Information Disclosure

@finastra/nestjs-proxy is vulnerable to information disclosure. The vulnerability exists in the ProxyService function due to a lack of sanitization in the authorization header which allows an unauthorized user to access sensitive information in the system...

CVE-2022-31070

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies e.g. session cookies from being forwarded to backend services configured by the application developer. This could have led to sensitive cooki...

CVE-2022-31069

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in...

Default configuration

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies e.g. session cookies from being forwarded to backend services configured by the application developer. This could have led to sensitive cooki...

Authorization

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in...

CVE-2022-31070 Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy

NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block sensitive cookies e.g. session cookies from being forwarded to backend services configured by the application developer. This could have led to sensitive cooki...

CVE-2022-31070

The CVE-2022-31070 issue affects the NestJS Proxy library. Prior to 0.7.0, nestjs-proxy could forward sensitive cookies (e.g., session cookies) to backend services, risking exposure. The fix is in @finastra/nestjs-proxy v0.7.0, which blocks cookies by default; an allowedCookies whitelist can be c...