Vulnerability record · CVE-2023-26108 · published 6 March 2023

CVE-2023-26108: Nestjs nest information exposure vulnerability

Nestjs · Nest

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

5.3 CVSS 3.1 Medium EPSS 0.71% · top 48.5% CWE-200 · Information exposure

5.3CVSS 3.1 base score

0.71%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nest Nestjs

References

Link	Tags
https://github.com/nestjs/nest/issues/9759	ExploitIssue TrackingThird Party Advisory
https://github.com/nestjs/nest/pull/9819	Issue TrackingPatch
https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41	Patch
https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127	Third Party Advisory
https://github.com/nestjs/nest/issues/9759	ExploitIssue TrackingThird Party Advisory
https://github.com/nestjs/nest/pull/9819	Issue TrackingPatch
https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41	Patch
https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127	Third Party Advisory

Track CVE-2023-26108 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-33011Nestjs nest vulnerabilityNest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platfor…EPSS 0.48%20 Mar 2026 8.2CVE-2026-2293Nestjs nest incorrect authorization vulnerabilityA NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization optio…EPSS 0.68%27 Feb 2026 7.5CVE-2026-40879Nestjs nest vulnerabilityNest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages …EPSS 0.46%21 Apr 2026 6.9CVE-2025-69211Nestjs nest toctou race condition vulnerabilityNest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. …EPSS 0.38%29 Dec 2025 6.3CVE-2026-35515Nestjs nest injection vulnerabilityNest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and me…EPSS 0.30%7 Apr 2026 5.5CVE-2024-29409Nestjs nest code injection vulnerabilityFile Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.EPSS 0.34%14 Mar 2025 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026 7.5CVE-2026-20133Cisco Catalyst SD-WAN Manager insufficient file system restrictions expose dataCisco Catalyst SD-WAN Software has insufficient file system restrictions that let an attacker read sensitive files on the underlying operating system…KEVEPSS 32%analysed25 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2023-26108), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.