Detections
Analytics

SCA: security update for @finastra/nestjs-proxy (GHSA-j562-c3cw-3p5g)

high Tenable Self-Hosted Container Security Plugin ID 416142

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy
 library did not have a way to control when Authorization headers should should be forwarded for specific
 backend services configured by the application developer. This could have resulted in sensitive
 information such as OAuth bearer access tokens being inadvertently exposed to such services that should
 not see them. A new feature has been introduced in the patched version of nestjs-proxy that allows
 application developers to opt out of forwarding the Authorization headers on a per service basis using the
 `forwardToken` config setting. Developers are advised to review the README for this library on Github or
 NPM for further details on how this configuration can be applied. This issue has been fixed in version
 0.7.0 of `@finastra/nestjs-proxy`. Users of `@ffdc/nestjs-proxy` are advised that this package has been
 deprecated and is no longer being maintained or receiving updates. Such users should update their
 package.json file to use `@finastra/nestjs-proxy` instead. (CVE-2022-31069)

See Also

https://github.com/advisories/GHSA-j562-c3cw-3p5g

Plugin Details

Severity: High

ID: 416142

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2022-31069

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/17/2022

Vulnerability Publication Date: 6/15/2022

Reference Information

CVE: CVE-2022-31069

cwe: CWE-200