NE
Vendor
nestjs
11
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102281 | NE nest nestjs | 7.5 | Sep 28 | Nest: Remote process termination via a deeply nested microservice message pattern |
| CVE-2026-54281 | NE nest nestjs | 8.7 | Jun 22 | Nest: Middleware Bypass on Fastify via Trailing Slash |
| CVE-2026-40879 | NE nest nestjs | 7.5 | Apr 21 | Nest: DoS via Recursive handleData in JsonSocket (TCP Transport) |
| CVE-2026-35515 | NE nest nestjs | 6.1 | Apr 7 | @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') |
| CVE-2026-33011 | NE nest nestjs | 7.5 | Mar 20 | Nest Fastify HEAD Request Middleware Bypass |
| CVE-2026-2293 | NE Nest Nestjs | 9.8 | Feb 27 | NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass |
| CVE-2025-69211 | NE nest nestjs | 7.4 | Dec 29 | Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) |
| CVE-2025-54782 | NE nest nestjs | 8.8 | Aug 1 | @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers |
| CVE-2024-29409 | NE Nest Nestjs | 5.5 | Mar 14 | File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header |
| CVE-2023-26108 | NE Nest Nestjs | 5.3 | Mar 6 | Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe |