GitHub Advisoryadvisory · npm

GHSA-cj7v-w2c7-cp7c nest allows a remote attacker to execute arbitrary code via the Content-Type header

MEDIUM Published 2025-03-14 Modified 2025-04-14 Official page ↗
Aliases
CVE-2024-29409
Ecosystem
npm
Packages
@nestjs/common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-94
Reviewed
2025-03-27

Affected packages

• npm @nestjs/common: >= 11.0.0-next.1, < 11.0.16 → fixed in 11.0.16 • npm @nestjs/common: < 10.4.16 → fixed in 10.4.16

Description

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.

Related

Alias · CVE (1)

  • CVE-2024-29409 File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References