CVE-2023-26108 @nestjs/core vulnerable to Information Exposure via StreamableFile pipe
Attackers can keep file streams open by canceling requests, potentially leading to resource exhaustion or information exposure in NestJS applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26108?
CVE-2023-26108 is a low-severity vulnerability in @nestjs/core, published on 6 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.
Weakness: CWE-200
Which versions are affected by CVE-2023-26108?
2 open source packages ship an affected version, including @nestjs/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nestjs/core npm | All versions | 9.0.5 |
@nestjs/core npm | All versions | 9.0.5 |
Products include Nestjs Nest.
How do I fix CVE-2023-26108?
Upgrade @nestjs/core to 9.0.5 or later.
Is CVE-2023-26108 being exploited?
There is no known exploitation of CVE-2023-26108 in the wild and no public exploit code.
Other vulnerabilities in @nestjs/core
- CVE-2026-33011 Nest Fastify HEAD Request Middleware Bypass
- CVE-2026-2293 NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass
- CVE-2026-40879 Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
- CVE-2025-69211 Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
- CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Sources
Also known as GHSA-4jpv-8r57-pv7j.