SB2026111325 - Multiple vulnerabilities in nest

Description

This security bulletin contains information about 2 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by exhausting heap memory and terminating the application process.

The vulnerability exists due to allocation of resources without aggregate limits in the Fastify adapter's multipart upload interceptors when parsing application/json fields into objects retained throughout a request. A remote attacker can send a multipart request containing excessive JSON field data within the default request limits to exhaust the heap and crash the process.

2) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by terminating the application process.

The vulnerability exists due to an uncaught exception in the NestJS router when a handler without a bound interceptor returns a Readable stream that fails before being read for a client-influenced path. A remote attacker can send a HEAD request or disconnect before the first chunk to trigger an unhandled stream error and crash the process.

Remediation

Install update from vendor's website.

References

• https://github.com/nestjs/nest/security/advisories/GHSA-h94v-c5rc-3pxm
• https://github.com/nestjs/nest/security/advisories/GHSA-q223-fc7f-xg75