@NESTJS/PLATFORM-EXPRESS · GHSA-c8fr-c7pf-58pf · Package
FIX → 12.5.0 · 11.2.10
The Express and Node adapters of NestJS set no default limit on the number of parts in a multipart upload. A single request of a few megabytes can make the server allocate memory until the process runs out of heap and terminates, which is a denial of service.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the default NestJS Express adapter, or @nestjs/platform-node, and have a route that accepts multipart uploads through the listed interceptors with default limits are exposed. No login is needed unless a guard protects the route. The Fastify adapter is not affected in the same way, because @fastify/multipart limits parts by default.
Not affected if custom-parts-limit, fastify-adapter, no-multipart-routes
Who cares express, file-uploads, nestjs, node
npm ls @nestjs/platform-express @nestjs/platform-nodeFileInterceptor, FilesInterceptor, FileFieldsInterceptor, or with default limits| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/platform-express, @nestjs/platform-node |
| Affected versions | @nestjs/platform-express < 11.2.10 and >= 12.0.0, < 12.5.0; @nestjs/platform-node >= 12.3.0, < 12.5.0 |
| Patched versions | 11.2.10 and 12.5.0 |
| Severity |
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
AnyFilesInterceptorNoFilesInterceptorlimits.parts in MulterModule.register() or interceptor optionsUpgrade to 12.5.0 · 11.2.10
@nestjs/platform-express: 11.2.10 for the 11.x line, 12.5.0 for the 12.x line@nestjs/platform-node: 12.5.0limits.parts (or limits.fields and limits.files) in MulterModule.register() or in each upload interceptor's options| High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |
The upload interceptors of the Express and Node adapters set no default limit on the number of parts in a multipart request. A single request of a few megabytes could make the server allocate memory until the process ran out of heap and terminated.
Applications using @nestjs/platform-express (the default adapter) or @nestjs/platform-node are affected when a route uses FileInterceptor, FilesInterceptor, FileFieldsInterceptor, AnyFilesInterceptor or NoFilesInterceptor with the default limits. No authentication is needed unless a guard protects the route. The Fastify adapter is not affected in the same way, because @fastify/multipart limits the number of parts by default.
Fixed in 11.2.10 and 12.5.0. Multipart requests are now limited to 1000 parts by default (limits.parts), counting fields and files together. Applications that need more must raise limits.parts.
Set limits.parts (or limits.fields and limits.files) in MulterModule.register() or in the options of each upload interceptor.
Reported by Anthropic's OSS Scanner.