3.7
Low
CVE-2023-26108 Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe
Description
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| @nestjs/core 9.0 | earliest → < 9.0.5 | 9.0.5 |