@NESTJS/COMMON · GHSA-jgpx-8x6j-fcpf · Package
FIX → 12.5.0 · 11.2.10
A multi-file upload validated by ParseFilePipe with FileTypeValidator can make @nestjs/common hold enough memory to exhaust the heap and terminate the process. An unauthenticated request carrying many small files is enough to crash the server.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications using the Express or Node adapter that accept arrays of files, keep uploads in memory, and validate them with ParseFilePipe and FileTypeValidator. Routes protected by a guard need credentials first, and routes that cap the file count with maxCount or limits.files or limits.parts are not exposed to this.
Not affected if auth-required, disk-storage, maxcount-set, no-file-type-validator
Who cares express, file-upload, nestjs, node
npm ls @nestjs/common.ParseFilePipe used with FileTypeValidator on FilesInterceptor without maxCount, or on AnyFilesInterceptor.| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/common |
| Affected versions | >= 9.3.10, < 11.2.10 and >= 12.0.0, < 12.5.0 |
| Patched versions | 11.2.10 and 12.5.0 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 12.5.0 · 11.2.10
@nestjs/common 11.2.10 for the 11.x line@nestjs/common 12.5.0 for the 12.x lineParseFilePipe validated all files of a multi-file upload at the same time. With FileTypeValidator, a single request carrying many small files could make the server hold enough memory to exhaust the heap and terminate the process.
An application is affected when it uses the Express or Node adapter, accepts an array of files (FilesInterceptor without maxCount, or AnyFilesInterceptor), keeps the uploads in memory (the default storage), and validates them with ParseFilePipe and FileTypeValidator. No authentication is needed unless a guard protects the route.
Fixed in 11.2.10 and 12.5.0. ParseFilePipe now validates the files one at a time and stops at the first invalid file.
Limit the number of files per request with maxCount, or with limits.files or limits.parts in the upload options.
Reported by Anthropic's OSS Scanner.