Packages / @nestjs/core / Security

ModerateVulnerabilityGHSA-4jpv-8r57-pv7jCVE-2023-26108Published 6 Mar 2023

@nestjs/core vulnerable to Information Exposure via StreamableFile pipe

Affected releases · @nestjs/core

  • 9.x9.0.0 – 9.0.4Fixed in 9.0.5
  • 8.x and older1.0.2 – 8.4.7No fix, no longer updated

On 9.x, the newest line:

npm install @nestjs/core@9.0.5
12.x

  1. Not affected

    12.0.0 – 12.2.0

    10 releases, latest

9.x

  1. Affected

    9.0.0 – 9.0.4

    5 releases

  2. Fixed

    9.0.5 – 9.4.3

    32 releases

8.x

  1. Affected

    8.0.0 – 8.4.7

    32 releases

7.x

  1. Affected

    7.0.0 – 7.6.18

    51 releases

6.x

  1. Affected

    6.0.0 – 6.11.11

    67 releases

5.x

  1. Affected

    5.0.0 – 5.7.4

    32 releases

4.x

  1. Affected

    4.0.0 – 4.6.6

    50 releases

3.x

  1. Affected

    3.0.0 – 3.1.1

    8 releases

2.x

  1. Affected

    2.0.0 – 2.1.2

    11 releases

1.x

  1. Affected

    1.0.2

    1 release

414 stable releases of @nestjs/core, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @nestjs/core. It is read in your browser and sent nowhere.

What happens

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.