Packages / @nestjs/common / Security

ModerateVulnerabilityGHSA-cj7v-w2c7-cp7cCVE-2024-29409Published 14 Mar 2025

nest allows a remote attacker to execute arbitrary code via the Content-Type header

Affected releases · @nestjs/common

  • 11.x11.0.0 – 11.0.15Fixed in 11.0.16
  • 10.x10.0.0 – 10.4.15Fixed in 10.4.16
  • 9.x and older1.0.0 – 9.4.3No fix, no longer updated

On 11.x, the newest line:

npm install @nestjs/common@11.0.16
12.x

  1. Not affected

    12.0.0 – 12.2.0

    10 releases, latest

11.x

  1. Affected

    11.0.0 – 11.0.15

    16 releases

  2. Fixed

    11.0.16 – 11.2.7

    44 releases

10.x

  1. Affected

    10.0.0 – 10.4.15

    48 releases

  2. Fixed

    10.4.16 – 10.4.22

    7 releases

9.x

  1. Affected

    9.0.0 – 9.4.3

    37 releases

8.x

  1. Affected

    8.0.0 – 8.4.7

    32 releases

7.x

  1. Affected

    7.0.0 – 7.6.18

    51 releases

6.x

  1. Affected

    6.0.0 – 6.11.11

    67 releases

5.x

  1. Affected

    5.0.0 – 5.7.4

    31 releases

4.x

  1. Affected

    4.0.0 – 4.6.6

    45 releases

3.x

  1. Affected

    3.0.0 – 3.1.1

    6 releases

2.x

  1. Affected

    2.0.0 – 2.1.2

    9 releases

1.x

  1. Affected

    1.0.0 – 1.0.2

    3 releases

406 stable releases of @nestjs/common, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @nestjs/common. It is read in your browser and sent nowhere.

What happens

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.