# Risk map — nestjs/nest

> Canonical page: https://codevetter.com/unpack/nest/risk-map

# Risk map — nestjs/nest

Scanned commit 35142c3eca8edaaf6abc5984d915da2fbd458aa2 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Important boundaries include input transformation, application-provided authorization, browser-origin checks, cookie signing, file streaming, and tooling subprocesses. Several runtime paths are excluded from coverage measurement, and integration exclusions leave configured verification gaps. Framework-wide changes to injection or adapter semantics have a broad compatibility surface.
- Initialization errors abort the process by default; setting abortOnError:false selects rethrow behavior instead. — [packages/core/nest-factory.ts#L243-266](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/nest-factory.ts#L243-L266) [packages/core/nest-factory.ts#L349-355](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/nest-factory.ts#L349-L355)
- The cats role guard depends on request.user supplied elsewhere; handlers without role metadata are allowed by this guard. — [sample/01-cats-app/src/common/guards/roles.guard.ts#L9-19](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/sample/01-cats-app/src/common/guards/roles.guard.ts#L9-L19)
- Cross-origin protection deliberately permits GET, HEAD, OPTIONS, and requests without Origin or Sec-Fetch-Site; it is not a general authentication boundary. — [packages/core/security/cross-origin-protection.ts#L66-112](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/security/cross-origin-protection.ts#L66-L112)
- Route-based CSRF exclusions fail closed for noncanonical paths, while a configured exclusion predicate returns its own decision directly. — [packages/core/security/cross-origin-protection.ts#L203-210](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/security/cross-origin-protection.ts#L203-L210) [packages/core/security/cross-origin-protection.ts#L311-329](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/security/cross-origin-protection.ts#L311-L329)
- CookieSigner validates nonempty signing secrets, uses HMAC-SHA256, verifies all rotation secrets, and compares equal-length signatures with timingSafeEqual. — [packages/core/helpers/cookies/cookie-signer.ts#L25-35](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/helpers/cookies/cookie-signer.ts#L25-L35) [packages/core/helpers/cookies/cookie-signer.ts#L49-81](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/helpers/cookies/cookie-signer.ts#L49-L81)
- Hypothesis: different ValidationPipe instances supplying custom packages may interact because validator and transformer references are module-level variables reassigned by constructors. (inferred) — [packages/common/pipes/validation.pipe.ts#L56-57](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/common/pipes/validation.pipe.ts#L56-L57) [packages/common/pipes/validation.pipe.ts#L104-105](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/common/pipes/validation.pipe.ts#L104-L105) [packages/common/pipes/validation.pipe.ts#L146-147](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/common/pipes/validation.pipe.ts#L146-L147)
- The SQL sample enables synchronize:true; its startup therefore includes ORM-managed schema synchronization and warrants review before reuse with valuable data. — [sample/05-sql-typeorm/src/app.module.ts#L7-16](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/sample/05-sql-typeorm/src/app.module.ts#L7-L16)
- StreamableFile's default pre-header error handler sends err.message in a 400 response; applications can replace that handler. — [packages/common/file-stream/streamable-file.ts#L20-34](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/common/file-stream/streamable-file.ts#L20-L34) [packages/common/file-stream/streamable-file.ts#L83-87](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/common/file-stream/streamable-file.ts#L83-L87)
- Adapter compatibility includes direct Node response writes and net.Server assumptions, beyond the nominal abstract method interface. — [packages/core/adapters/http-adapter.ts#L42-47](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/packages/core/adapters/http-adapter.ts#L42-L47)
- Docker tooling forwards CLI arguments into spawnSync and enables shell execution on Windows; this is an inspected contributor-tool subprocess boundary. — [scripts/docker-compose.js#L13-21](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/scripts/docker-compose.js#L13-L21) [scripts/docker-compose.js#L35-52](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/scripts/docker-compose.js#L35-L52)
- The PR content guard uses pull_request_target with comment-write permission but reads changed content through APIs; it flags incomplete scans at GitHub's 3000-file limit. — [.github/workflows/pr-content-guard.yml#L8-15](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/.github/workflows/pr-content-guard.yml#L8-L15) [.github/workflows/pr-content-guard.yml#L28-36](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/.github/workflows/pr-content-guard.yml#L28-L36) [.github/workflows/pr-content-guard.yml#L60-87](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/.github/workflows/pr-content-guard.yml#L60-L87)
- Coverage command failure suppression and excluded integration suites mean successful CI job completion alone cannot establish every inspected critical flow passed. (inferred) — [package.json#L32-38](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/package.json#L32-L38) [vitest.config.integration.mts#L51-59](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/vitest.config.integration.mts#L51-L59) [.circleci/config.yml#L71-78](https://github.com/nestjs/nest/blob/35142c3eca8edaaf6abc5984d915da2fbd458aa2/.circleci/config.yml#L71-L78)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)