CVE-2023-26108

Published: Mar 6, 2023Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

Affected (1)

Products: Nestjs: Nest

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nestjs Nest	Before 9.0.5

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

https://github.com/nestjs/nest/issues/9759

Source: report@snyk.io

ExploitIssue TrackingThird Party Advisory

https://github.com/nestjs/nest/pull/9819

Source: report@snyk.io

Issue TrackingPatch

https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41

Source: report@snyk.io

Patch

https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127

Source: report@snyk.io

Third Party Advisory

https://github.com/nestjs/nest/issues/9759

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://github.com/nestjs/nest/pull/9819

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.