Nestjs vulnerabilities
We track 7 vulnerabilities in Nestjs products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
Latest Nestjs vulnerabilities
- 7.5 High severity
nest: Uncaught Exception
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage
- 8.7 High severity
nest: Incorrect Authorization
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an authentication bypass vulnerability exists in @nestjs/platform-fastify. When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fa
- 7.5 High severity
nest: Uncontrolled Recursion
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never
- 7.5 High severity
nest: Always-Incorrect Control Flow Implementation
Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the correspon
- 9.8 Critical severity
nest.js: Incorrect Authorization
A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.
- 7.4 High severity
nest: Time-of-check Time-of-use (TOCTOU) Race Condition
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `NestMiddleware` (via `Midd
- 8.8 High severity
nest: Improper Neutralization of Special Elements used in a Command
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local