nestjs vulnerabilities
7 published CVEs name nestjs among the affected products.
- 7Published CVEs7 of them scored
- 6Last 12 monthspublished in the last year
- 1Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-102281
Nest: Remote process termination via a deeply nested microservice message pattern
nestjs · nest
High7.5 - CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash
nestjs · nest
High8.7 - CVE-2026-40879
Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
nestjs · nest
High7.5 - CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
nestjs · nest
Medium6.3 - CVE-2026-33011
Nest Fastify HEAD Request Middleware Bypass
nestjs · nest
High8.7 - CVE-2025-69211
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
nestjs · nest
Medium6.9 - CVE-2025-54782
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
nestjs · nest
Critical9.4