Skip to main content

Nest

4 CVEs product

Monthly

CVE-2025-36939 Aug 24, 16:38 CRITICAL Act Now

Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.

Buffer Overflow Denial Of Service Nest Stack Overflow
NVD
CVSS 4.0
10.0
EPSS
0.2%
CVE-2026-2293 Feb 27, 17:16 npm HIGH PATCH This Week

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

Authentication Bypass Nest
NVD GitHub VulDB
CVSS 4.0
8.2
EPSS
0.1%
CVE-2024-29409 Mar 14, 18:15 npm MEDIUM POC PATCH This Month

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

RCE Code Injection File Upload Nest
NVD GitHub
CVSS 3.1
5.5
EPSS
0.2%
CVE-2023-26108 Mar 06, 05:15 npm MEDIUM POC PATCH This Month

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Nest
NVD GitHub
CVSS 3.1
5.3
EPSS
0.7%
EPSS 0% CVSS 10.0
CRITICAL Act Now

Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.

Buffer Overflow Denial Of Service Nest +1
NVD
EPSS 0% CVSS 8.2
HIGH PATCH This Week

A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13.

Authentication Bypass Nest
NVD GitHub VulDB
EPSS 0% CVSS 5.5
MEDIUM POC PATCH This Month

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

RCE Code Injection File Upload +1
NVD GitHub
EPSS 1% CVSS 5.3
MEDIUM POC PATCH This Month

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Nest
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy