Is @nestjs/core 8.3 vulnerable?
npm · 2 releases from 8.3.0 to 8.3.1 · latest @nestjs/core is 12.3.2 · checked 2 Nov 2026
Yes: 2 known advisories
Yes. @nestjs/core 8.3.1, the last 8.3 release, is affected by 2 known security advisories (2 medium), including CVE-2026-35515, CVE-2023-26108. Upgrade to 11.1.18 or later to fix all of them.
npm install @nestjs/core@11.1.18Advisories affecting @nestjs/core 8.3.1
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')
- Affected
- <11.1.18
- Fixed in
- 11.1.18
@nestjs/core vulnerable to Information Exposure via StreamableFile pipe
- Affected
- <9.0.5
- Fixed in
- 9.0.5
Which of your client projects are still on @nestjs/core 8.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact @nestjs/core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other @nestjs/core versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.