Skip to content
OpenAdvisories

Vendor

nestjs

7 known vulnerabilities.

nestjs at a glance

Last 12 months
6
Critical · all time
1
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 2 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202620
Mar 202610
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202511
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

nest 7
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 7.5
    CVE-2026-102281

    Nest: Remote process termination via a deeply nested microservice message pattern

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessag…

    nestjs nest @nestjs/microservices npm
  • High 8.7
    CVE-2026-54281

    Nest: Middleware Bypass on Fastify via Trailing Slash

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the F…

    nestjs nest @nestjs/platform-fastify npm
  • High 7.5
    CVE-2026-40879

    Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never…

    nestjs nest @nestjs/microservices npm
  • Medium 6.3
    CVE-2026-35515

    @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n).…

    nestjs nest @nestjs/core npm
  • High 8.7
    CVE-2026-33011

    Nest Fastify HEAD Request Middleware Bypass

    Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the correspo…

    nestjs nest @nestjs/platform-fastify npm
  • Medium 6.9
    CVE-2025-69211

    Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

    Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `Mid…

    nestjs nest @nestjs/platform-fastify npm
  • Critical 9.4
    CVE-2025-54782 Public exploit EPSS 47%

    @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

    Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local…

    nestjs nest @nestjs/devtools-integration npm