nestjs has 5 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 7.4 (high). None have a confirmed exploitation report. Most affected products: @nestjs/platform-fastify (2), nest (2), @nestjs/microservices (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 1
Products
- @nestjs/platform-fastify 2
- nest 2
- @nestjs/microservices 1
Worst active — by depth score
CVE-2026-102281High· 7.5Nest is a framework for building scalable Node.js server-side applications53GHSA-9c5c-9qcx-q35qHigh· 7.4@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets41CVE-2026-54281HighNest: Middleware Bypass on Fastify via Trailing Slash41CVE-2025-69211High· 7.4Nest is a framework for building scalable Node.js server-side applications41GHSA-96h4-vgxj-gvm2Medium· 6.5Nest: Unbounded memory growth in the NestJS TCP microservice transport36
nestjs vulnerabilities
CVEs affecting nestjs, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
GHSA-9c5c-9qcx-q35qHigh· 7.4@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
GHSA-96h4-vgxj-gvm2Medium· 6.5Nest: Unbounded memory growth in the NestJS TCP microservice transport
Nest: Unbounded memory growth in the NestJS TCP microservice transport
CVE-2026-102281High· 7.5PoCNest is a framework for building scalable Node.js server-side applications
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. …
CVE-2026-54281HighNest: Middleware Bypass on Fastify via Trailing Slash
Nest: Middleware Bypass on Fastify via Trailing Slash
CVE-2025-69211High· 7.4Nest is a framework for building scalable Node.js server-side applications
Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses `@nestjs/platform-fastify`; relies on `Nes…