CVE-2023-26108: NestJS Core information exposure in StreamableFile pipe

CVE-2023-26108 · Severity: low · CVSS 3.1 · Published 2023-03-06

NestJS Core is a widely-used Node.js framework for building server applications. When a client cancels a request during file streaming via the StreamableFile component, the underlying file stream is not properly closed, causing resource leaks. While the impact is limited to resource exhaustion rather than data exposure, sufficient leaked connections could degrade service availability.

Technologies: NestJS. Vendors: NestJS, npm.

Quick answers

Is CVE-2023-26108 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-26108 being exploited in the wild.
How severe is CVE-2023-26108?
Low severity, with a CVSS score of 3.1, published 6 March 2023.
Which products and versions are affected?
NestJS < 9.0.5; @nestjs/core (npm) SEMVER:introduced=0,fixed=9.0.5.
Is there a fix for CVE-2023-26108?
Yes. @nestjs/core (npm): upgrade to 9.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26108 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-26108?
Check whether you run NestJS or @nestjs/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nestjs/core (npm): upgrade to 9.0.5 or later
    npm install @nestjs/core@9.0.5

Technical details

This vulnerability exists in the StreamableFile pipe component of @nestjs/core versions prior to 9.0.5. The root cause is improper stream cleanup when a client cancels or abruptly terminates an HTTP request during file streaming. The vulnerability is triggered by a network-based attack vector requiring no authentication or user interaction—an attacker can simply initiate file download requests and cancel them repeatedly. When exploited, streams are left open indefinitely, consuming server resources (file descriptors, memory) until the process is restarted or the OS enforces limits. The fix, released in version 9.0.5, replaced the vulnerable `stream.pipe()` mechanism with the more robust `pipeline()` API, which automatically destroys streams on error or client disconnection. The issue affects the Express adapter specifically; Fastify handles streams correctly by default.

Affected products

  • NestJS @nestjs/core < 9.0.5

Identifiers

  • CVE-2023-26108
  • GHSA-4jpv-8r57-pv7j

Timeline

  • 2023-03-06: disclosed: Vulnerability published in GitHub Advisory Database and NVD
  • 2023-03-06: patched: Fix released in @nestjs/core version 9.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.