CVE-2024-29409

nest allows a remote attacker to execute arbitrary code via the Content-Type header

5.5 MediumFix available

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.34%Up 0.3 points since Mar 15, 2025

What each source reports

CVE List Score used 5.5

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Record: CVE-2024-29409
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2024-26416 5.5

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Record: EUVD-2024-26416
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cj7v-w2c7-cp7c 5.5

nest allows a remote attacker to execute arbitrary code via the Content-Type header

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.

Record: GHSA-cj7v-w2c7-cp7c
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

NVD 5.5

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Record: CVE-2024-29409
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

OSV 5.5

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

Record: CVE-2024-29409
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVGHSA-cj7v-w2c7-cp7c 5.5

nest allows a remote attacker to execute arbitrary code via the Content-Type header

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.

Record: GHSA-cj7v-w2c7-cp7c
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weakness: CWE-94
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-29409 No score

CVE-2024-29409 in @rootio/nestjs__common - Patched by Root

Root has patched CVE-2024-29409 in the @rootio/nestjs__common package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-29409
Updated: 2026-11-02

Affected products

nestjs nest

Affected packages

Affected packages
Package	Affected	Fixed
`@nestjs/common` npm	11.0.0-next.1 up to 11.0.16	11.0.16
`@nestjs/common` npm	before 10.4.16	10.4.16
`@rootio/nestjs__common` Root:npm	before 10.3.8-root.io.1	10.3.8-root.io.110.3.8-root.io.210.3.8-root.io.310.3.0-root.io.19.0.7-root.io.110.2.5-root.io.1
`@nestjs/common` Root:npm	before 10.3.8-aikido.2	10.3.8-aikido.210.3.8-aikido.310.3.0-aikido.19.0.7-aikido.110.2.5-aikido.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-29409 is a medium vulnerability (CVSS 5.5) in Nestjs Nest, published March 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 26th percentile. Fixed in @nestjs/common 11.0.16.

References

Show 5 moreShow less