Middleware Bypass on Fastify via Trailing Slash
NestJS security advisories
All 7 advisories NestJS has published with an identifier, newest first. Severity is the one its publisher assigned, and the fix is the release the publisher named. Nothing on this page is our judgement.
- Advisories
- 77 carry a CVE
- critical
- 1
- high
- 5
- medium
- 1
- Fix in the archive
- 6of 7 matched to a release
- Oldest
- 1 Aug 20251.1 years ago
1 of these point at a version older than anything the archive holds, so there is no release page to link. That is a gap in what was collected, not evidence that the fix does not exist. This page is a copy of what the publisher published, kept for reference. The authoritative source for a security question is the publisher, and an advisory missing from here is not evidence that none exists. What this page does and does not tell you sets out the limits in full.
Newest first
Every productDoS via Recursive handleData in JsonSocket (TCP Transport)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in @nestjs/core
Fastify HEAD Request Middleware Bypass
Fastify URL Encoding Middleware Bypass
Fastify URL Encoding Middleware Bypass (TOCTOU)
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers