CVE-2023-26108: @nestjs/core vulnerable to Information Exposure via StreamableFile pipe

March 6, 2023 (updated November 7, 2023)

Versions of the package @nestjs/core before 9.0.5 is vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

References

github.com/advisories/GHSA-4jpv-8r57-pv7j
github.com/nestjs/nest/issues/9759
github.com/nestjs/nest/pull/9819
github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41
nvd.nist.gov/vuln/detail/CVE-2023-26108
security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127

Code Behaviors & Features

Detect and mitigate CVE-2023-26108 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →