CVE-2024-29409 nest allows a remote attacker to execute arbitrary code via the Content-Type header
Remote attackers can execute arbitrary code via the Content-Type header in the NestJS framework.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29409?
CVE-2024-29409 is a medium-severity vulnerability in n/a, published on 14 Mar 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.
Weakness: CWE-94
Which versions are affected by CVE-2024-29409?
4 open source packages ship an affected version, including @nestjs/common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nestjs/common npm | All versions | 10.4.16 |
@nestjs/common npm | All versions | 10.4.16 |
@nestjs/common npm | From 11.0.0-next.1 | 11.0.16 |
@nestjs/common npm | From 11.0.0-next.1 | 11.0.16 |
Products include Nestjs Nest.
How do I fix CVE-2024-29409?
Upgrade @nestjs/common to a fixed version for your release line: 10.4.16 or 11.0.16.
Is CVE-2024-29409 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29409 exists.
Other vulnerabilities in n/a
- CVE-2026-33011 Nest Fastify HEAD Request Middleware Bypass
- CVE-2026-2293 NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass
- CVE-2026-40879 Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
- CVE-2025-69211 Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
- CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
Sources
Also known as GHSA-cj7v-w2c7-cp7c, ROOT-APP-NPM-CVE-2024-29409.