Medium, CVSS 6.5
Nest: Unbounded memory growth in the NestJS TCP microservice transport
npm @nestjs/microservices · Upgrade to 12.0.3 or 11.2.5 by release line · < 11.2.5; >= 12.0.0, < 12.0.3 · GHSA-96h4-vgxj-gvm2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
51–54 of 54 matching · newest first
- High, CVSS 7.4
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
npm @nestjs/platform-fastify · Upgrade to 12.0.2 or 11.2.4 by release line · < 11.2.4; >= 12.0.0, < 12.0.2 · GHSA-9c5c-9qcx-q35q · amended
- High, CVSS 7.5
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
npm nodemailer · Upgrade to 10.0.5 or later · >= 9.1.0, <= 10.0.4 · CVE-2026-90776 · GHSA-prgh-xp8r-p3m5 · amended
- Medium, CVSS 4.4
PyJWT: ReDoS vulnerability when calling the
is_pem_formatfunction.PyPI pyjwt · Upgrade to 2.14.0 or later · <= 2.13.0 · CVE-2026-102270 · GHSA-jwrc-g2q2-pq5p · amended
A vendor fix does not resolve your finding until you verify it in your own systems.