CVE-2024-29409: Code Injection
Published Mar 14, 2025
·Updated
File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.
Affected Software
5 affected componentsFixes available
nestjs NestJS
nestjs Nest Node.js=10.3.2
npm/@nestjs/common<10.4.16
10.4.16
npm/@nestjs/common>=11.0.0-next.1<11.0.16
11.0.16
IBM Concert Software<=1.0.0-1.1.0
Event History
Mar 14, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
via GitHub·06:30 PM
Sep 1, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-29409?
CVE-2024-29409 has been classified with a high severity level due to its potential to allow arbitrary code execution.
2
How do I fix CVE-2024-29409?
To mitigate CVE-2024-29409, upgrade to NestJS version 10.4.16 or 11.0.16 or later.
3
Which versions of NestJS are affected by CVE-2024-29409?
CVE-2024-29409 affects NestJS versions prior to 10.4.16 and versions before 11.0.16.
4
What type of vulnerability is CVE-2024-29409?
CVE-2024-29409 is a file upload vulnerability that can be exploited via the Content-Type header.
5
Can CVE-2024-29409 be exploited remotely?
Yes, CVE-2024-29409 allows remote attackers to execute arbitrary code.