CVE-2026-33011

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Always-Incorrect Control Flow Implementation pada nestjs nest. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Nest is a framework for building scalable Node.js server-side applications. In versions 11.1.15 and below, a NestJS application using @nestjs/platform-fastify GET middleware can be bypassed because Fastify automatically redirects HEAD requests to the corresponding GET handlers (if they exist). As a result: middleware will be completely skipped, the HTTP response won't include a body (since the response is truncated when redirecting a HEAD request to a GET handler), and the actual handler will still be executed. This issue is fixed in version 11.1.16.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nestjs/nest/security/advisories/GHSA-wf42-42fg-fg84 advisory vendor
• https://github.com/nestjs/nest/commit/cbdf737cd6e7cefa52d05ecea2ae4af95c464614 patch
• https://github.com/nestjs/nest/releases/tag/v11.1.17 product · release notes