CVE-2023-26108
Low
Description
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.
SeverityLow
CVSS3.7
Exploit probability—
Product
Nest
PublishedMar 6, 2023
First seenMar 6, 2023
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- nestjs nest9.0.5 or later
- @nestjs/core9.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nestjs nest | v < 9.0.5 | 9.0.5 |
| @nestjs/corenpm | v < 9.0.5 | 9.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.