Skip to content
Threat Feed
Subscribe

Tag

Nestjs

4 briefs RSS
high threat

Path-Scoped Middleware Bypass in @nestjs/platform-fastify

An improper handling of absolute-form HTTP request targets in @nestjs/platform-fastify allows attackers to bypass path-scoped middleware by inducing a path resolution mismatch between the router and the middleware layer.

exploited @nestjs/platform-fastify +1 middleware-bypass web-application-security nestjs fastify npm
2t
low advisory

Remote Denial of Service in NestJS Microservices via Deeply Nested Patterns

An unhandled stack overflow exception in @nestjs/microservices, triggered by deeply nested JSON message patterns, allows unauthenticated remote attackers to crash Node.js processes using TCP or RabbitMQ transports.

@nestjs/microservices +1 denial-of-service npm nestjs
1t 1c
high advisory

NestJS Uncontrolled Recursion Denial-of-Service Vulnerability (CVE-2026-40879)

NestJS versions before 11.1.19 are susceptible to an uncontrolled recursion vulnerability (CVE-2026-40879) where sending many small JSON messages in a single TCP frame triggers a call stack overflow, resulting in a denial-of-service condition.

denial-of-service nestjs recursion cve-2026-40879 linux
2r 1t 1c
high advisory

NestJS Microservices Denial-of-Service via Recursive handleData

A denial-of-service vulnerability exists in NestJS's @nestjs/microservices package, affecting versions 11.1.18 and earlier, where an attacker can send multiple small, valid JSON messages within a single TCP frame, causing a stack overflow.

nestjs denial-of-service microservices
2r 1t