en
NestJS, also known as Nest, is an open-source Node.js framework maintained by the Nest project community. It provides a modular architecture, dependency injection, TypeScript support, and integrations for building server-side web applications, APIs, and microservices. It is used by individual developers and organizations worldwide.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/23/2026, nestjs recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, nest had the most security vulnerabilities in the nestjs ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message patternCVE-2026-54281Nest: Middleware Bypass on Fastify via Trailing SlashCVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')CVE-2026-33011Nest Fastify HEAD Request Middleware Bypass| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message pattern | Exploitation statusActively exploited | FixYes | Affected productnest | Published09/28/2026 | SeverityHigh |
CVE-2026-54281Nest: Middleware Bypass on Fastify via Trailing Slash | Exploitation statusNot exploited | FixYes | Affected productnest | Published06/22/2026 | |
CVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport) | Exploitation statusNot exploited | FixYes | Affected productnest | Published04/21/2026 | |
CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') | Exploitation statusNot exploited | FixYes | Affected productnest | Published | |
CVE-2026-33011Nest Fastify HEAD Request Middleware Bypass | Exploitation statusNot exploited | FixYes | Affected productnest | Published03/20/2026 | |
CVE-2026-2293NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass | Exploitation statusActively exploited | FixYes | Affected productnest.js | Published | |
CVE-2025-69211Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) | Exploitation statusActively exploited | FixNo | Affected productnest | Published | |
CVE-2025-54782@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers | Exploitation statusActively exploited | FixYes | Affected productnest | Published | |
CVE-2024-29409CVE-2024-29409 | Exploitation statusActively exploited | FixNo | Affected product- | Published03/14/2025 | SeverityMedium |
CVE-2023-26108CVE-2023-26108 | Exploitation statusNot exploited | FixYes | Affected product@nestjs/core | Published03/06/2023 |
10 Results | Page 1 of 1
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |
| SeverityHigh |
| SeverityMedium |
| SeverityCritical |