@NESTJS/CORE · GHSA-q223-fc7f-xg75 · Package
FIX → 12.5.0
When a NestJS route handler returns a Node.js Readable stream that fails before it is read, such as a missing file, the error goes unhandled and terminates the process. A single HEAD request or an early client disconnect is enough to crash the server.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications on @nestjs/core 12.4.x that return a Readable stream from a route handler, for a path a client can influence, and that bind no interceptor to that route. The flaw applies on every HTTP adapter. Applications on versions before 12.4.0 do not support returning a Readable this way, and routes whose streams are wrapped in StreamableFile or checked for existence first are not exposed.
Not affected if no-readable-return, pre-12.4.0, streamable-file
Who cares nestjs, node, npm, self-hosted
npm ls @nestjs/core; affected versions are >= 12.4.0, < 12.5.0.Readable (for example fs.createReadStream) on paths a client can influence, without a StreamableFile wrapper or an interceptor on that route.Upgrade to 12.5.0
| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/core |
| Affected versions | >= 12.4.0, < 12.5.0 |
| Patched versions | 12.5.0 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
| CWE | CWE-248 (Uncaught Exception) |
Since 12.4.0, a route handler may return a Node.js Readable stream. A stream that failed before it was read, for example of a file that does not exist, raised an error that nothing handled, which terminated the process. A single request, or a client that disconnected before the first chunk, was enough.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
@nestjs/core: 12.5.0StreamableFile, or check that the file exists before opening the stream.fs.createReadStream()HEADApplications on 12.4.x that return a Readable from a handler, for a path a client can influence, and bind no interceptor to that route are affected, on every HTTP adapter. No authentication is needed unless a guard protects the route. Versions before 12.4.0 do not support returning a Readable this way.
Fixed in 12.5.0. The router now handles the errors of every stream it holds, including streams it stops without reading.
Wrap the stream in a StreamableFile, or check that the file exists before opening the stream.
Reported by Anthropic's OSS Scanner.