Information Exposure Vulnerability in @nestjs/core by NestJS

CVE-2023-26108

What is CVE-2023-26108?

Versions of the @nestjs/core package prior to 9.0.5 are susceptible to an information exposure issue related to the StreamableFile pipe. This vulnerability arises when a client cancels a request during the streaming of a StreamableFile, which inadvertently keeps the stream open. This may result in sensitive information becoming accessible unintentionally, thereby posing a security risk to applications utilizing this package.

References