Excessive Iteration in nest - #VU166175

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by blocking the event loop.

The vulnerability exists due to excessive iteration in the @nestjs/platform-fastify multipart parser when processing sparse array field names, with processing time proportional to the largest array index rather than the number of submitted fields. A remote attacker can send a small multipart request containing field names with large array indices to a route using an upload interceptor to block the event loop, while some field names also trigger HTTP 500 errors.

Affected software

Remediation

External References

• https://github.com/nestjs/nest/security/advisories/GHSA-hpvc-wj3g-h9p8

Related Security Bulletins

• Multiple vulnerabilities in nest