nest
- Software type
- Web framework
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/23/2026, nest recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of nest and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message patternCVE-2026-54281Nest: Middleware Bypass on Fastify via Trailing SlashCVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')CVE-2026-33011Nest Fastify HEAD Request Middleware Bypass| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message pattern | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-54281Nest: Middleware Bypass on Fastify via Trailing Slash | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport) | Exploitation statusNot exploited | FixYes | Published04/21/2026 | SeverityHigh |
|---|
CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityMedium |
|---|
CVE-2026-33011Nest Fastify HEAD Request Middleware Bypass | Exploitation statusNot exploited | FixYes | Published03/20/2026 | SeverityHigh |
|---|
CVE-2026-2293NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass | Exploitation statusActively exploited | FixYes | Published02/27/2026 | SeverityHigh |
|---|
CVE-2025-69211Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) | Exploitation statusActively exploited | FixNo | Published12/29/2025 | SeverityMedium |
|---|
CVE-2025-54782@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers | Exploitation statusActively exploited | FixYes | Published08/01/2025 | SeverityCritical |
|---|
CVE-2024-29409CVE-2024-29409 | Exploitation statusActively exploited | FixNo | Published03/14/2025 | SeverityMedium |
|---|
CVE-2023-26108CVE-2023-26108 | Exploitation statusNot exploited | FixYes | Published03/06/2023 | SeverityLow |
|---|
10 Results | Page 1 of 1