SB2026091619 - Multiple vulnerabilities in nest

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in ServerTCP#handleMessage and ServerRMQ#handleMessage when serializing a client-supplied deeply nested message pattern. A remote attacker can send a specially crafted microservice message to cause a denial of service.

Only microservices using the TCP or RabbitMQ transport are affected.

2) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication or authorization.

The vulnerability exists due to an interpretation conflict in the Fastify adapter's path-scoped middleware matching when processing HTTP requests with absolute-form request targets. A remote attacker can send an HTTP request with an absolute-form request target to bypass authentication or authorization.

Only applications that bind middleware to specific paths through MiddlewareConsumer.forRoutes(...) or .exclude(...) are affected.

Remediation

Install update from vendor's website.

References

• https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
• https://github.com/nestjs/nest/security/advisories/GHSA-9c5c-9qcx-q35q