NestJS Security Hunting

Hunt NestJS-specific vulnerabilities in guard bypass via decorator stack gaps, Reflector metadata mismatches between global/controller/method guards, ValidationPipe whitelist and transform exploits, and microservice transport authentication drift. NestJS's architectural patterns — decorators, dependency injection, module system, multi-transport support — create unique attack surface across HTTP, WebSocket, and RPC transports.

When to Use

• Target uses NestJS (indicated by x-powered-by: NestJS or TypeScript decorator patterns in error messages).
• GraphQL endpoints exist alongside REST API.
• Microservice transports (TCP, Redis, NATS, MQTT, gRPC) are configured.
• Swagger/OpenAPI docs are exposed at /api or /api-json.
• CRUD endpoints follow predictable NestJS naming conventions.

Quick Detection

# NestJS fingerprinting
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/api" | grep -iE "x-powered-by|server"
# Look for: x-powered-by: NestJS