NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

CLSA-2026-1790882031 TuxCare security update for @nestjs (1 CVE)

TuxCare rebuilt 8 @nestjs packages to address 1 CVE. Fixed in 11.2.4-tuxcare.1...

CLSA-2026-1790881234 TuxCare security update for @nestjs (2 CVEs)

TuxCare rebuilt 9 @nestjs packages to address 2 CVEs. Fixed in 11.2.3-tuxcare.1...

CLSA-2026-1790872587 TuxCare security update for @nestjs (2 CVEs)

TuxCare rebuilt 9 @nestjs packages to address 2 CVEs. Fixed in 11.2.2-tuxcare.1...

CLSA-2026-1790870019 TuxCare security update for @nestjs (1 CVE)

TuxCare rebuilt 9 @nestjs packages to address 1 CVE. Fixed in 10.4.22-tuxcare.3...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by unknown CVE via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +25 more potentially affected by unknown CVE via @nestjs/microservices (>=11.0.1, <=11.2.4)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...

GHSA-96H4-VGXJ-GVM2 Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

Allocation of Resources Without Limits or Throttling

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded memory growth in the TCP transport layer of JsonSocket. On the receiving...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @bioinfornatics/gpt-image-mcp (>=0.1.1, <=0.1.7) +12 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=11.0.1, <=11.2.3)

@nestjs/platform-fastify NPM version =11.0.1, =6.0.0-alpha.1, =0.1.1, =0.2.1, =1.0.3-alpha.0b30e6d.0, =1.0.11, =0.1.51, =1.0.36, =0.1.4, =1.3.0, =11.1.0, =2.6.18, =5.0.0-beta.36, =0.6.1-dev, =0.1.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-9C5C-9QCX-Q35Q...

@homebridge/homebridge-apt-pkg (>=1.7.0, <=2.0.20-legacy.20260924), @mp-consulting/homebridge-config-glass-ui (>=1.0.0, <=2.0.0-beta.2) +10 more potentially affected by unknown CVE via @nestjs/platform-fastify (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/platform-fastify NPM version =12.0.0-alpha.2, =1.7.0, =1.0.0, =1.0.0, =2.0.0, =0.7.0, =0.7.0, =0.8.4-beta.1, =5.28.1-beta.9, =2.2.2-beta.4, =2.0.0-beta.5, =14.3.8, =15.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-9C5C-9QCX-Q35Q...

GHSA-9C5C-9QCX-Q35Q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

Interpretation Conflict

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: CVE-2026-102281 Source advisory: OSV:GHSA-M8VH-JMQ9-5RJG...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +25 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: OSV:GHSA-M8VH-JMQ9-5RJG...

Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

GHSA-M8VH-JMQ9-5RJG Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +25 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: SNYK:JS-NESTJSMICROSERVICES-20251033...