CVE-2024-29409: Code Injection

Q: What is the severity of CVE-2024-29409?

CVE-2024-29409 has been classified with a high severity level due to its potential to allow arbitrary code execution.

Q: How do I fix CVE-2024-29409?

To mitigate CVE-2024-29409, upgrade to NestJS version 10.4.16 or 11.0.16 or later.

Q: Which versions of NestJS are affected by CVE-2024-29409?

CVE-2024-29409 affects NestJS versions prior to 10.4.16 and versions before 11.0.16.

Q: What type of vulnerability is CVE-2024-29409?

CVE-2024-29409 is a file upload vulnerability that can be exploited via the Content-Type header.

Q: Can CVE-2024-29409 be exploited remotely?

Yes, CVE-2024-29409 allows remote attackers to execute arbitrary code.

Published Mar 14, 2025

Updated

File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.

Other sources

File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.

— MITRE

Affected Software

5 affected componentsFixes available

nestjs NestJS

nestjs Nest Node.js=10.3.2

npm/@nestjs/common<10.4.16

10.4.16

npm/@nestjs/common>=11.0.0-next.1<11.0.16

11.0.16

IBM Concert Software<=1.0.0-1.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@nestjs/common to a version that resolves this vulnerability.
Fixed in 10.4.16
Upgrade
Upgrade npm/@nestjs/common to a version that resolves this vulnerability.
Fixed in 11.0.16

Event History

Mar 14, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Advisory Published

via GitHub·06:30 PM

Sep 1, 2025

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7243699

Frequently Asked Questions

What is the severity of CVE-2024-29409?