-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe primary vulnerability stemmed from ExpressAdapter's use of stream.pipe() instead of stream.pipeline(), which doesn't automatically close streams on cancellation/errors. The StreamableFile's error handler was also insufficient as it didn't account for mid-stream failures. The fix in PR #9819 replaced pipe() with pipeline() and added robust error handling, confirming these were the problematic areas.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @nestjs/core | npm | < 9.0.5 | 9.0.5 |
Ongoing coverage of React2Shell