{"id":"GHSA-c8fr-c7pf-58pf","kind":"vulnerability","aliases":["GHSA-c8fr-c7pf-58pf"],"related":[],"title":"Process crash via a multipart request with many fields on the Express and Node adapters","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/platform-express`, `@nestjs/platform-node` |\n| Affected versions | `@nestjs/platform-express` `< 11.2.10` and `>= 12.0.0, < 12.5.0`; `@nestjs/platform-node` `>= 12.3.0, < 12.5.0` |\n| Patched versions | `11.2.10` and `12.5.0` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (7.5) |\n| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |\n\n### Summary\n\nThe upload interceptors of the Express and Node adapters set no default limit on the number of parts in a multipart request. A single request of a few megabytes could make the server allocate memory until the process ran out of heap and terminated.\n\n### Impact\n\nApplications using `@nestjs/platform-express` (the default adapter) or `@nestjs/platform-node` are affected when a route uses `FileInterceptor`, `FilesInterceptor`, `FileFieldsInterceptor`, `AnyFilesInterceptor` or `NoFilesInterceptor` with the default limits. No authentication is needed unless a guard protects the route. The Fastify adapter is not affected in the same way, because `@fastify/multipart` limits the number of parts by default.\n\n### Patches\n\nFixed in **11.2.10** and **12.5.0**. Multipart requests are now limited to 1000 parts by default (`limits.parts`), counting fields and files together. Applications that need more must raise `limits.parts`.\n\n### Workarounds\n\nSet `limits.parts` (or `limits.fields` and `limits.files`) in `MulterModule.register()` or in the options of each upload interceptor.\n\n### Credit\n\nReported by Anthropic's OSS Scanner.","summary":"The Express and Node adapters of NestJS set no default limit on the number of parts in a multipart upload. A single request of a few megabytes can make the server allocate memory until the process runs out of heap and terminates, which is a denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/platform-express","fixed":["12.5.0"],"affected":">= 12.0.0, < 12.5.0","ecosystem":"npm"},{"name":"@nestjs/platform-express","fixed":["11.2.10"],"affected":"< 11.2.10","ecosystem":"npm"},{"name":"@nestjs/platform-node","fixed":["12.5.0"],"affected":">= 12.3.0, < 12.5.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","cwe-770","express","file-uploads","nestjs","node","package"],"not_affected_if":["custom-parts-limit","fastify-adapter","no-multipart-routes"],"how_to_check":"- Check the installed version: `npm ls @nestjs/platform-express @nestjs/platform-node`\n- Look for routes using `FileInterceptor`, `FilesInterceptor`, `FileFieldsInterceptor`, `AnyFilesInterceptor` or `NoFilesInterceptor` with default limits\n- Search the code for `limits.parts` in `MulterModule.register()` or interceptor options","fix":"- `@nestjs/platform-express`: `11.2.10` for the 11.x line, `12.5.0` for the 12.x line\n- `@nestjs/platform-node`: `12.5.0`\n- Workaround named by the advisory: set `limits.parts` (or `limits.fields` and `limits.files`) in `MulterModule.register()` or in each upload interceptor's options","status":"open","published_at":"2026-11-12T19:03:43+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","triaged_at":"2026-11-12T19:15:49+00:00","updated_at":"2026-11-12T19:15:49+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T19:15:49Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/platform-express`: `11.2.10` for the 11.x line, `12.5.0` for the 12.x line\n- `@nestjs/platform-node`: `12.5.0`\n- Workaround named by the advisory: set `limits.parts` (or `limits.fields` and `limits.files`) in `MulterModule.register()` or in each upload interceptor's options","reach":"internet","title":"NestJS: multipart uploads with many fields crash the Node process","impact":"medium","summary":"The Express and Node adapters of NestJS set no default limit on the number of parts in a multipart upload. A single request of a few megabytes can make the server allocate memory until the process runs out of heap and terminates, which is a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","node","express","file-uploads"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated requests crash the server process repeatedly","analyst_note":"","how_to_check":"- Check the installed version: `npm ls @nestjs/platform-express @nestjs/platform-node`\n- Look for routes using `FileInterceptor`, `FilesInterceptor`, `FileFieldsInterceptor`, `AnyFilesInterceptor` or `NoFilesInterceptor` with default limits\n- Search the code for `limits.parts` in `MulterModule.register()` or interceptor options","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fastify-adapter","no-multipart-routes","custom-parts-limit"],"who_is_affected":"Applications that use the default NestJS Express adapter, or @nestjs/platform-node, and have a route that accepts multipart uploads through the listed interceptors with default limits are exposed. No login is needed unless a guard protects the route. The Fastify adapter is not affected in the same way, because @fastify/multipart limits parts by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000891,"input_tokens":5292,"output_tokens":723,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':30B,135C '-770':32B,126C '1000':250C '11.2.10':98C,107C,241C '12.0.0':100C '12.3.0':103C '12.5.0':101C,104C,109C,243C '58pf':20A,25A '7.5':123C 'adapt':15A,44B,148C,190C,221C 'affect':95C,194C,224C 'alloc':71B,127C,173C 'anthrop':287C 'anyfilesinterceptor':202C 'applic':185C,260C 'authent':210C 'av':114C 'c7pf':19A,24A 'c8fr':18A,23A 'consumpt':138C 'could':169C 'count':255C 'crash':2A 'credit':284C 'cvss':112C 'cwe':29B,31B,124C,125C,134C 'default':49B,151C,189C,207C,237C,253C 'denial':85B 'ecosystem':90C 'express':12A,33B,41B,145C 'fastifi':220C 'fastify/multipart':230C 'field':9A,88C,256C 'file':35B,258C 'file-upload':34B 'filefieldsinterceptor':201C 'fileinterceptor':199C 'filesinterceptor':200C 'fix':239C 'ghsa':17A,22A 'ghsa-c8fr-c7pf-58pf':16A,21A 'guard':215C 'h':122C 'heap':79B,181C 'high':111C 'impact':184C 'interceptor':142C,283C 'l/pr':116C 'limit':50B,131C,152C,208C,231C,248C 'limits.fields':271C 'limits.files':273C 'limits.parts':254C,266C,269C 'make':68B,170C 'mani':8A 'megabyt':66B,168C 'memori':72B,174C 'multermodule.register':275C 'multipart':5A,58B,160C,244C 'must':264C 'n/a':121C 'n/ac':115C 'n/i':120C 'n/s':118C 'n/ui':117C 'need':212C,262C 'nestj':37B,46B 'nestjs/platform-express':26A,27A,93C,97C,187C 'nestjs/platform-node':28A,94C,102C,192C 'node':14A,38B,43B,147C 'nofilesinterceptor':204C 'npm':91C 'number':53B,155C,233C 'option':279C 'oss':289C 'packag':39B,92C 'part':55B,157C,235C,251C 'patch':105C,238C 'process':1A,75B,177C 'protect':216C 'rais':265C 'ran':178C 'report':285C 'request':6A,62B,161C,164C,245C 'resourc':129C,137C 'rout':197C,218C 'run':76B 'scanner':290C 'server':70B,172C 'servic':87B 'set':47B,149C,268C 'sever':110C 'singl':61B,163C 'summari':139C 'termin':81B,183C 'throttl':133C 'togeth':259C 'u/c':119C 'uncontrol':136C 'unless':213C 'upload':36B,59B,141C,282C 'use':186C,198C 'v3.1':113C 'valu':89C 'version':96C,106C 'via':3A 'way':228C 'without':130C 'workaround':267C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the default NestJS Express adapter, or @nestjs/platform-node, and have a route that accepts multipart uploads through the listed interceptors with default limits are exposed. No login is needed unless a guard protects the route. The Fastify adapter is not affected in the same way, because @fastify/multipart limits parts by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["platformexpress","platformnode"],"ptokens":["express","nestjs","node","platform"],"labels":["cwe400","cwe770","express","fileuploads","high","nestjs","node","npm","package"],"campaign_type":null,"search_a":"'58pf':20A,25A 'adapt':15A 'c7pf':19A,24A 'c8fr':18A,23A 'crash':2A 'express':12A 'field':9A 'ghsa':17A,22A 'ghsa-c8fr-c7pf-58pf':16A,21A 'mani':8A 'multipart':5A 'nestjs/platform-express':26A,27A 'nestjs/platform-node':28A 'node':14A 'process':1A 'request':6A 'via':3A","search_b":"'-400':30B '-770':32B 'adapt':44B 'alloc':71B 'cwe':29B,31B 'default':49B 'denial':85B 'express':33B,41B 'file':35B 'file-upload':34B 'heap':79B 'limit':50B 'make':68B 'megabyt':66B 'memori':72B 'multipart':58B 'nestj':37B,46B 'node':38B,43B 'number':53B 'packag':39B 'part':55B 'process':75B 'request':62B 'run':76B 'server':70B 'servic':87B 'set':47B 'singl':61B 'termin':81B 'upload':36B,59B","search_c":"'-400':135C '-770':126C '1000':250C '11.2.10':98C,107C,241C '12.0.0':100C '12.3.0':103C '12.5.0':101C,104C,109C,243C '7.5':123C 'adapt':148C,190C,221C 'affect':95C,194C,224C 'alloc':127C,173C 'anthrop':287C 'anyfilesinterceptor':202C 'applic':185C,260C 'authent':210C 'av':114C 'consumpt':138C 'could':169C 'count':255C 'credit':284C 'cvss':112C 'cwe':124C,125C,134C 'default':151C,189C,207C,237C,253C 'ecosystem':90C 'express':145C 'fastifi':220C 'fastify/multipart':230C 'field':88C,256C 'file':258C 'filefieldsinterceptor':201C 'fileinterceptor':199C 'filesinterceptor':200C 'fix':239C 'guard':215C 'h':122C 'heap':181C 'high':111C 'impact':184C 'interceptor':142C,283C 'l/pr':116C 'limit':131C,152C,208C,231C,248C 'limits.fields':271C 'limits.files':273C 'limits.parts':254C,266C,269C 'make':170C 'megabyt':168C 'memori':174C 'multermodule.register':275C 'multipart':160C,244C 'must':264C 'n/a':121C 'n/ac':115C 'n/i':120C 'n/s':118C 'n/ui':117C 'need':212C,262C 'nestjs/platform-express':93C,97C,187C 'nestjs/platform-node':94C,102C,192C 'node':147C 'nofilesinterceptor':204C 'npm':91C 'number':155C,233C 'option':279C 'oss':289C 'packag':92C 'part':157C,235C,251C 'patch':105C,238C 'process':177C 'protect':216C 'rais':265C 'ran':178C 'report':285C 'request':161C,164C,245C 'resourc':129C,137C 'rout':197C,218C 'scanner':290C 'server':172C 'set':149C,268C 'sever':110C 'singl':163C 'summari':139C 'termin':183C 'throttl':133C 'togeth':259C 'u/c':119C 'uncontrol':136C 'unless':213C 'upload':141C,282C 'use':186C,198C 'v3.1':113C 'valu':89C 'version':96C,106C 'way':228C 'without':130C 'workaround':267C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:03:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-c8fr-c7pf-58pf","url":"https://github.com/nestjs/nest/security/advisories/GHSA-c8fr-c7pf-58pf","severity":"high","published_at":"2026-11-12T19:03:43+00:00","modified_at":"2026-11-12T19:03:43+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","fetched_at":"2026-11-12T19:14:24+00:00","note":null}],"documents":[{"id":137724,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-c8fr-c7pf-58pf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}