NestJS Nest

NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass

Nest Fastify HEAD Request Middleware Bypass

Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)

Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.