Medium · 5.5 CVE-2024-29409 EUVD-2024-26416GHSA-cj7v-w2c7-cp7c

nest allows a remote attacker to execute arbitrary code via the Content-Type header

Published Mar 14, 2025 · Updated Mar 17, 2025 · Assigned by mitre

Description

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Ecosystem	Package	Affected	Fixed	Record
npm	@nestjs/common	>= 11.0.0-next.1, < 11.0.16	11.0.16	GHSA-cj7v-w2c7-cp7c
npm	@nestjs/common	< 10.4.16	10.4.16	GHSA-cj7v-w2c7-cp7c