Is @nestjs/core 7.6 vulnerable?
npm · 19 releases from 7.6.0 to 7.6.18 · latest @nestjs/core is 12.3.2 · checked 2 Nov 2026
Yes: 2 known advisories
Yes. @nestjs/core 7.6.18, the last 7.6 release, is affected by 2 known security advisories (2 medium), including CVE-2026-35515, CVE-2023-26108. Upgrade to 11.1.18 or later to fix all of them.
npm install @nestjs/core@11.1.18Advisories affecting @nestjs/core 7.6.18
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
- Affected
- <11.1.18
- Fixed in
- 11.1.18
@nestjs/core vulnerable to Information Exposure via StreamableFile pipe
- Affected
- <9.0.5
- Fixed in
- 9.0.5
Which of your client projects are still on @nestjs/core 7.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @nestjs/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @nestjs/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.