Every CVE whose affected-product data names Nestjs Nest, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (7)
CVE-2026-2293 — CVSS 9.8 (critical): A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify…
CVE-2026-33011 — CVSS 7.5 (high): Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using…
CVE-2026-40879 — CVSS 7.5 (high): Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON…
CVE-2025-69211 — CVSS 7.4 (high): Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding…
CVE-2026-35515 — CVSS 6.1 (medium): Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates…
CVE-2024-29409 — CVSS 5.5 (medium): File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.
CVE-2023-26108 — CVSS 3.7 (low): Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this…