medium5.3
CVE-2023-26108
@nestjs/core vulnerable to Information Exposure via StreamableFile pipe
Impact
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @nestjs/core | < 9.0.5 | 9.0.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nestjs | Nest | before 9.0.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nestjs/nest/issues/9759
- https://github.com/nestjs/nest/pull/9819
- https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41
- https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127
- https://github.com/advisories/GHSA-4jpv-8r57-pv7j
- https://nvd.nist.gov/vuln/detail/CVE-2023-26108