CVE-2023-26108: Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible…

PriorityP426medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.71%

48.8th percentile

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
nestjs	core	< 9.0.5	9.0.5
nestjs	core	>= 0 < 9.0.5	9.0.5
nestjs	nest	< 9.0.5	9.0.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.