CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

• CWE-200

• https://github.com/nestjs/nest/issues/9759Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nestjs/nest/pull/9819Issue Tracking, Patch
• https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41Patch
• https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127Third Party Advisory
• https://github.com/nestjs/nest/issues/9759Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nestjs/nest/pull/9819Issue Tracking, Patch
• https://github.com/nestjs/nest/pull/9819/commits/f59cf5e81ca73bcdf1b5b36713550fd93918db41Patch
• https://security.snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127Third Party Advisory

Published

Mar 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26102All versions of the package rangy are vulnerable to Prototyp…8.2
• CVE-2023-26103Versions of the package deno before 1.31.0 are vulnerable to…7.5
• CVE-2023-26104All versions of the package lite-web-server are vulnerable t…7.5
• CVE-2023-26105All versions of the package utilities are vulnerable to Prot…7.5
• CVE-2023-26106All versions of the package dot-lens are vulnerable to Proto…7.5
• CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbi…7.8
• CVE-2023-26109All versions of the package node-bluetooth-serial-port are v…9.8
• CVE-2023-2611Advantech R-SeeNet versions 2.4.22 is installed with a hi…9.8
• CVE-2023-26110All versions of the package node-bluetooth are vulnerable to…9.8
• CVE-2023-26111All versions of the package @nubosoftware/node-static; all v…7.5
• CVE-2023-26112All versions of the package configobj are vulnerable to Regu…5.9
• CVE-2023-26113Versions of the package collection.js before 6.8.1 are vulne…7.5