nest allows a remote attacker to execute arbitrary code via the Content-Type header

中危 5.5CVE-2024-29409 · GHSA-cj7v-w2c7-cp7c · Published 14/03/2025 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
nest nestjs	`= 10.3.2`	No fix yet
@nestjs/common npm	`≥ 11.0.0-next.1, < 11.0.16< 10.4.16`	`11.0.1610.4.16`

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.

NVD description

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

= 10.3.2

No fix yet

npm

≥ 11.0.0-next.1, < 11.0.16< 10.4.16

11.0.1610.4.16

nest 的其他漏洞

查看全部 →