Nestjs Nest
9 CVEs affecting Nestjs Nest. Latest disclosed: 2026-06-22. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2293 | Critical | 9.8 | 2026-02-27 | A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are ena… |
CVE-2025-54782 | High | 8.8 | 2025-08-02 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability w… |
CVE-2026-40879 | High | 7.5 | 2026-04-21 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP… |
CVE-2026-33011 | High | 7.5 | 2026-03-20 | Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify… |
CVE-2025-69211 | High | 7.4 | 2025-12-29 | Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS a… |
CVE-2026-35515 | Medium | 6.1 | 2026-04-07 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id d… |
CVE-2024-29409 | Medium | 5.5 | 2025-03-14 | File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. |
CVE-2023-26108 | Low | 3.7 | 2023-03-06 | Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible… |
CVE-2026-54281 | | 2026-06-22 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform… |