SB2026111324 - Multiple vulnerabilities in nest

Description

This security bulletin contains information about 2 vulnerabilities.

1) Excessive Iteration (CVE-ID: N/A)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by blocking the event loop.

The vulnerability exists due to excessive iteration in the @nestjs/platform-fastify multipart parser when processing sparse array field names, with processing time proportional to the largest array index rather than the number of submitted fields. A remote attacker can send a small multipart request containing field names with large array indices to a route using an upload interceptor to block the event loop, while some field names also trigger HTTP 500 errors.

2) Interpretation Conflict (CVE-ID: N/A)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass middleware-based authentication and authorization checks and access or modify protected data.

The vulnerability exists due to an interpretation conflict between Fastify routing and Nest middleware path matching in @nestjs/platform-fastify when processing empty route parameters. A remote attacker can send a request with an empty route parameter to execute a protected route handler without running middleware bound through MiddlewareConsumer.forRoutes(...).

Remediation

Install update from vendor's website.

References

• https://github.com/nestjs/nest/security/advisories/GHSA-hpvc-wj3g-h9p8
• https://github.com/nestjs/nest/security/advisories/GHSA-c987-fv5x-hmpg