{"id":"GHSA-jgpx-8x6j-fcpf","kind":"vulnerability","aliases":["GHSA-jgpx-8x6j-fcpf"],"related":[],"title":"Process crash via many files validated at once by ParseFilePipe","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/common` |\n| Affected versions | `>= 9.3.10, < 11.2.10` and `>= 12.0.0, < 12.5.0` |\n| Patched versions | `11.2.10` and `12.5.0` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (7.5) |\n| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |\n\n### Summary\n\n`ParseFilePipe` validated all files of a multi-file upload at the same time. With `FileTypeValidator`, a single request carrying many small files could make the server hold enough memory to exhaust the heap and terminate the process.\n\n### Impact\n\nAn application is affected when it uses the Express or Node adapter, accepts an array of files (`FilesInterceptor` without `maxCount`, or `AnyFilesInterceptor`), keeps the uploads in memory (the default storage), and validates them with `ParseFilePipe` and `FileTypeValidator`. No authentication is needed unless a guard protects the route.\n\n### Patches\n\nFixed in **11.2.10** and **12.5.0**. `ParseFilePipe` now validates the files one at a time and stops at the first invalid file.\n\n### Workarounds\n\nLimit the number of files per request with `maxCount`, or with `limits.files` or `limits.parts` in the upload options.\n\n### Credit\n\nReported by Anthropic's OSS Scanner.","summary":"A multi-file upload validated by ParseFilePipe with FileTypeValidator can make @nestjs/common hold enough memory to exhaust the heap and terminate the process. An unauthenticated request carrying many small files is enough to crash the server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/common","fixed":["12.5.0"],"affected":">= 12.0.0, < 12.5.0","ecosystem":"npm"},{"name":"@nestjs/common","fixed":["11.2.10"],"affected":">= 9.3.10, < 11.2.10","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","cwe-770","express","file-upload","nestjs","node","package"],"not_affected_if":["auth-required","disk-storage","maxcount-set","no-file-type-validator"],"how_to_check":"- Check the installed version with `npm ls @nestjs/common`.\n- Search the code for `ParseFilePipe` used with `FileTypeValidator` on `FilesInterceptor` without `maxCount`, or on `AnyFilesInterceptor`.\n- Check whether uploads use the default in-memory storage.","fix":"- `@nestjs/common` `11.2.10` for the 11.x line\n- `@nestjs/common` `12.5.0` for the 12.x line","status":"open","published_at":"2026-11-12T19:03:46+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","triaged_at":"2026-11-12T19:15:49+00:00","updated_at":"2026-11-12T19:15:49+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T19:15:49Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/common` `11.2.10` for the 11.x line\n- `@nestjs/common` `12.5.0` for the 12.x line","reach":"internet","title":"NestJS: many-file upload to ParseFilePipe can crash the Node process","impact":"medium","summary":"A multi-file upload validated by ParseFilePipe with FileTypeValidator can make @nestjs/common hold enough memory to exhaust the heap and terminate the process. An unauthenticated request carrying many small files is enough to crash the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","node","express","file-upload"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Single request crashes the Node process through heap exhaustion","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @nestjs/common`.\n- Search the code for `ParseFilePipe` used with `FileTypeValidator` on `FilesInterceptor` without `maxCount`, or on `AnyFilesInterceptor`.\n- Check whether uploads use the default in-memory storage.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["maxcount-set","disk-storage","no-file-type-validator","auth-required"],"who_is_affected":"Applications using the Express or Node adapter that accept arrays of files, keep uploads in memory, and validate them with ParseFilePipe and FileTypeValidator. Routes protected by a guard need credentials first, and routes that cap the file count with maxCount or limits.files or limits.parts are not exposed to this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000814,"input_tokens":5127,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':24B,114C '-770':26B,105C '11.2.10':80C,86C,208C '12.0.0':82C '12.5.0':83C,88C,210C '7.5':102C '8x6j':14A,19A '9.3.10':79C 'accept':170C 'adapt':169C 'affect':77C,161C 'alloc':106C 'anthrop':249C 'anyfilesinterceptor':179C 'applic':159C 'array':172C 'authent':196C 'av':93C 'carri':61B,138C 'consumpt':117C 'could':142C 'crash':2A,68B 'credit':246C 'cvss':91C 'cwe':23B,25B,103C,104C,113C 'default':186C 'ecosystem':73C 'enough':48B,66B,147C 'exhaust':51B,150C 'express':27B,166C 'fcpf':15A,20A 'field':71C 'file':5A,29B,37B,64B,122C,127C,141C,174C,215C,226C,232C 'file-upload':28B 'filesinterceptor':175C 'filetypevalid':43B,134C,194C 'first':224C 'fix':206C 'ghsa':12A,17A 'ghsa-jgpx-8x6j-fcpf':11A,16A 'guard':201C 'h':101C 'heap':53B,152C 'high':90C 'hold':47B,146C 'impact':157C 'invalid':225C 'jgpx':13A,18A 'keep':180C 'l/pr':95C 'limit':110C,228C 'limits.files':239C 'limits.parts':241C 'make':45B,143C 'mani':4A,62B,139C 'maxcount':177C,236C 'memori':49B,148C,184C 'multi':36B,126C 'multi-fil':35B,125C 'n/a':100C 'n/ac':94C 'n/i':99C 'n/s':97C 'n/ui':96C 'need':198C 'nestj':31B 'nestjs/common':21A,22A,46B,76C 'node':32B,168C 'npm':74C 'number':230C 'one':216C 'option':245C 'oss':251C 'packag':33B,75C 'parsefilepip':10A,41B,119C,192C,211C 'patch':84C,205C 'per':233C 'process':1A,57B,156C 'protect':202C 'report':247C 'request':60B,137C,234C 'resourc':108C,116C 'rout':204C 'scanner':252C 'server':70B,145C 'sever':89C 'singl':136C 'small':63B,140C 'stop':221C 'storag':187C 'summari':118C 'termin':55B,154C 'throttl':112C 'time':132C,219C 'u/c':98C 'unauthent':59B 'uncontrol':115C 'unless':199C 'upload':30B,38B,128C,182C,244C 'use':164C 'v3.1':92C 'valid':6A,39B,120C,189C,213C 'valu':72C 'version':78C,85C 'via':3A 'without':109C,176C 'workaround':227C","nicknames":[],"mitigations":[],"who_affected":"Applications using the Express or Node adapter that accept arrays of files, keep uploads in memory, and validate them with ParseFilePipe and FileTypeValidator. Routes protected by a guard need credentials first, and routes that cap the file count with maxCount or limits.files or limits.parts are not exposed to this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["common"],"ptokens":["common","nestjs"],"labels":["cwe400","cwe770","express","fileupload","high","nestjs","node","npm","package"],"campaign_type":null,"search_a":"'8x6j':14A,19A 'crash':2A 'fcpf':15A,20A 'file':5A 'ghsa':12A,17A 'ghsa-jgpx-8x6j-fcpf':11A,16A 'jgpx':13A,18A 'mani':4A 'nestjs/common':21A,22A 'parsefilepip':10A 'process':1A 'valid':6A 'via':3A","search_b":"'-400':24B '-770':26B 'carri':61B 'crash':68B 'cwe':23B,25B 'enough':48B,66B 'exhaust':51B 'express':27B 'file':29B,37B,64B 'file-upload':28B 'filetypevalid':43B 'heap':53B 'hold':47B 'make':45B 'mani':62B 'memori':49B 'multi':36B 'multi-fil':35B 'nestj':31B 'nestjs/common':46B 'node':32B 'packag':33B 'parsefilepip':41B 'process':57B 'request':60B 'server':70B 'small':63B 'termin':55B 'unauthent':59B 'upload':30B,38B 'valid':39B","search_c":"'-400':114C '-770':105C '11.2.10':80C,86C,208C '12.0.0':82C '12.5.0':83C,88C,210C '7.5':102C '9.3.10':79C 'accept':170C 'adapt':169C 'affect':77C,161C 'alloc':106C 'anthrop':249C 'anyfilesinterceptor':179C 'applic':159C 'array':172C 'authent':196C 'av':93C 'carri':138C 'consumpt':117C 'could':142C 'credit':246C 'cvss':91C 'cwe':103C,104C,113C 'default':186C 'ecosystem':73C 'enough':147C 'exhaust':150C 'express':166C 'field':71C 'file':122C,127C,141C,174C,215C,226C,232C 'filesinterceptor':175C 'filetypevalid':134C,194C 'first':224C 'fix':206C 'guard':201C 'h':101C 'heap':152C 'high':90C 'hold':146C 'impact':157C 'invalid':225C 'keep':180C 'l/pr':95C 'limit':110C,228C 'limits.files':239C 'limits.parts':241C 'make':143C 'mani':139C 'maxcount':177C,236C 'memori':148C,184C 'multi':126C 'multi-fil':125C 'n/a':100C 'n/ac':94C 'n/i':99C 'n/s':97C 'n/ui':96C 'need':198C 'nestjs/common':76C 'node':168C 'npm':74C 'number':230C 'one':216C 'option':245C 'oss':251C 'packag':75C 'parsefilepip':119C,192C,211C 'patch':84C,205C 'per':233C 'process':156C 'protect':202C 'report':247C 'request':137C,234C 'resourc':108C,116C 'rout':204C 'scanner':252C 'server':145C 'sever':89C 'singl':136C 'small':140C 'stop':221C 'storag':187C 'summari':118C 'termin':154C 'throttl':112C 'time':132C,219C 'u/c':98C 'uncontrol':115C 'unless':199C 'upload':128C,182C,244C 'use':164C 'v3.1':92C 'valid':120C,189C,213C 'valu':72C 'version':78C,85C 'without':109C,176C 'workaround':227C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:03:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-jgpx-8x6j-fcpf","url":"https://github.com/nestjs/nest/security/advisories/GHSA-jgpx-8x6j-fcpf","severity":"high","published_at":"2026-11-12T19:03:46+00:00","modified_at":"2026-11-12T19:03:46+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","fetched_at":"2026-11-12T19:14:24+00:00","note":null}],"documents":[{"id":137723,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-jgpx-8x6j-fcpf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}