{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "@mapbox/node-pre-gyp": {
      "name": "@mapbox/node-pre-gyp",
      "severity": "high",
      "isDirect": false,
      "via": [
        "tar"
      ],
      "effects": [],
      "range": "<=1.0.11",
      "nodes": [
        "node_modules/@mapbox/node-pre-gyp"
      ],
      "fixAvailable": true
    },
    "@nestjs/common": {
      "name": "@nestjs/common",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        "file-type"
      ],
      "effects": [],
      "range": "10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
      "nodes": [
        "node_modules/@nestjs/common"
      ],
      "fixAvailable": {
        "name": "@nestjs/common",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "@nestjs/core": {
      "name": "@nestjs/core",
      "severity": "moderate",
      "isDirect": true,
      "via": [
        {
          "source": 1117063,
          "name": "@nestjs/core",
          "dependency": "@nestjs/core",
          "title": "@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')",
          "url": "https://github.com/advisories/GHSA-36xv-jgw5-4q75",
          "severity": "moderate",
          "cwe": [
            "CWE-74"
          ],
          "cvss": {
            "score": 6.1,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L"
          },
          "range": "<=11.1.17"
        }
      ],
      "effects": [],
      "range": "<=11.1.17",
      "nodes": [
        "node_modules/@nestjs/core"
      ],
      "fixAvailable": {
        "name": "@nestjs/core",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "@nestjs/platform-express": {
      "name": "@nestjs/platform-express",
      "severity": "high",
      "isDirect": true,
      "via": [
        "body-parser",
        "express",
        "multer"
      ],
      "effects": [],
      "range": "<=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
      "nodes": [
        "node_modules/@nestjs/platform-express"
      ],
      "fixAvailable": {
        "name": "@nestjs/platform-express",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "body-parser": {
      "name": "body-parser",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "qs"
      ],
      "effects": [
        "@nestjs/platform-express"
      ],
      "range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
      "nodes": [
        "node_modules/body-parser"
      ],
      "fixAvailable": {
        "name": "@nestjs/platform-express",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "esbuild": {
      "name": "esbuild",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1102341,
          "name": "esbuild",
          "dependency": "esbuild",
          "title": "esbuild enables any website to send any requests to the development server and read the response",
          "url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
          "severity": "moderate",
          "cwe": [
            "CWE-346"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
          },
          "range": "<=0.24.2"
        }
      ],
      "effects": [
        "vite"
      ],
      "range": "<=0.24.2",
      "nodes": [
        "node_modules/vite/node_modules/esbuild"
      ],
      "fixAvailable": {
        "name": "vite",
        "version": "8.1.1",
        "isSemVerMajor": true
      }
    },
    "express": {
      "name": "express",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        "qs"
      ],
      "effects": [
        "@nestjs/platform-express"
      ],
      "range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
      "nodes": [
        "node_modules/express"
      ],
      "fixAvailable": {
        "name": "@nestjs/platform-express",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "file-type": {
      "name": "file-type",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1114301,
          "name": "file-type",
          "dependency": "file-type",
          "title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
          "url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
          "severity": "moderate",
          "cwe": [
            "CWE-835"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=13.0.0 <21.3.1"
        },
        {
          "source": 1114726,
          "name": "file-type",
          "dependency": "file-type",
          "title": "file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry",
          "url": "https://github.com/advisories/GHSA-j47w-4g3g-c36v",
          "severity": "moderate",
          "cwe": [
            "CWE-400",
            "CWE-409"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=20.0.0 <=21.3.1"
        }
      ],
      "effects": [
        "@nestjs/common"
      ],
      "range": "13.0.0 - 21.3.1",
      "nodes": [
        "node_modules/file-type"
      ],
      "fixAvailable": {
        "name": "@nestjs/common",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "multer": {
      "name": "multer",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1113635,
          "name": "multer",
          "dependency": "multer",
          "title": "Multer vulnerable to Denial of Service via incomplete cleanup",
          "url": "https://github.com/advisories/GHSA-xf7r-hgr6-v32p",
          "severity": "high",
          "cwe": [
            "CWE-459"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.1.0"
        },
        {
          "source": 1113636,
          "name": "multer",
          "dependency": "multer",
          "title": "Multer vulnerable to Denial of Service via resource exhaustion",
          "url": "https://github.com/advisories/GHSA-v52c-386h-88mc",
          "severity": "high",
          "cwe": [
            "CWE-772"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.1.0"
        },
        {
          "source": 1113996,
          "name": "multer",
          "dependency": "multer",
          "title": "Multer Vulnerable to Denial of Service via Uncontrolled Recursion",
          "url": "https://github.com/advisories/GHSA-5528-5vmv-3xc2",
          "severity": "high",
          "cwe": [
            "CWE-674"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<2.1.1"
        },
        {
          "source": 1121089,
          "name": "multer",
          "dependency": "multer",
          "title": "Multer vulnerable to Denial of Service via deeply nested field names",
          "url": "https://github.com/advisories/GHSA-72gw-mp4g-v24j",
          "severity": "high",
          "cwe": [
            "CWE-400"
          ],
          "cvss": {
            "score": 7.5,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
          },
          "range": ">=1.0.0 <2.2.0"
        },
        {
          "source": 1121091,
          "name": "multer",
          "dependency": "multer",
          "title": "Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",
          "url": "https://github.com/advisories/GHSA-3p4h-7m6x-2hcm",
          "severity": "moderate",
          "cwe": [
            "CWE-459"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=2.0.0-alpha.1 <2.2.0"
        }
      ],
      "effects": [
        "@nestjs/platform-express"
      ],
      "range": "<=2.1.1",
      "nodes": [
        "node_modules/multer"
      ],
      "fixAvailable": {
        "name": "@nestjs/platform-express",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "qs": {
      "name": "qs",
      "severity": "moderate",
      "isDirect": false,
      "via": [
        {
          "source": 1119502,
          "name": "qs",
          "dependency": "qs",
          "title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
          "url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
          "severity": "moderate",
          "cwe": [
            "CWE-476"
          ],
          "cvss": {
            "score": 5.3,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
          },
          "range": ">=6.11.1 <=6.15.1"
        }
      ],
      "effects": [
        "body-parser",
        "express"
      ],
      "range": "6.11.1 - 6.15.1",
      "nodes": [
        "node_modules/qs"
      ],
      "fixAvailable": {
        "name": "@nestjs/platform-express",
        "version": "11.1.27",
        "isSemVerMajor": true
      }
    },
    "tar": {
      "name": "tar",
      "severity": "high",
      "isDirect": false,
      "via": [
        {
          "source": 1112659,
          "name": "tar",
          "dependency": "tar",
          "title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
          "url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-59"
          ],
          "cvss": {
            "score": 8.2,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
          },
          "range": "<7.5.7"
        },
        {
          "source": 1113300,
          "name": "tar",
          "dependency": "tar",
          "title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
          "url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=7.5.2"
        },
        {
          "source": 1113375,
          "name": "tar",
          "dependency": "tar",
          "title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
          "url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 7.1,
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
          },
          "range": "<7.5.8"
        },
        {
          "source": 1114200,
          "name": "tar",
          "dependency": "tar",
          "title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
          "url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-59"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=7.5.9"
        },
        {
          "source": 1114302,
          "name": "tar",
          "dependency": "tar",
          "title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
          "url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
          "severity": "high",
          "cwe": [
            "CWE-22"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=7.5.10"
        },
        {
          "source": 1114680,
          "name": "tar",
          "dependency": "tar",
          "title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
          "url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
          "severity": "high",
          "cwe": [
            "CWE-176",
            "CWE-367"
          ],
          "cvss": {
            "score": 8.8,
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
          },
          "range": "<=7.5.3"
        },
        {
          "source": 1120782,
          "name": "tar",
          "dependency": "tar",
          "title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
          "url": "https://github.com/advisories/GHSA-vmf3-w455-68vh",
          "severity": "moderate",
          "cwe": [
            "CWE-436"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=7.5.15"
        }
      ],
      "effects": [
        "@mapbox/node-pre-gyp"
      ],
      "range": "<=7.5.15",
      "nodes": [
        "node_modules/tar"
      ],
      "fixAvailable": true
    },
    "vite": {
      "name": "vite",
      "severity": "high",
      "isDirect": true,
      "via": [
        {
          "source": 1116229,
          "name": "vite",
          "dependency": "vite",
          "title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
          "url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
          "severity": "moderate",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=6.4.1"
        },
        {
          "source": 1120784,
          "name": "vite",
          "dependency": "vite",
          "title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
          "url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
          "severity": "moderate",
          "cwe": [
            "CWE-73",
            "CWE-522"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=6.4.2"
        },
        {
          "source": 1120789,
          "name": "vite",
          "dependency": "vite",
          "title": "vite: `server.fs.deny` bypass on Windows alternate paths",
          "url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
          "severity": "high",
          "cwe": [
            "CWE-22",
            "CWE-200"
          ],
          "cvss": {
            "score": 0,
            "vectorString": null
          },
          "range": "<=6.4.2"
        },
        "esbuild"
      ],
      "effects": [],
      "range": "<=6.4.2",
      "nodes": [
        "node_modules/vite"
      ],
      "fixAvailable": {
        "name": "vite",
        "version": "8.1.1",
        "isSemVerMajor": true
      }
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 7,
      "high": 5,
      "critical": 0,
      "total": 12
    },
    "dependencies": {
      "prod": 220,
      "dev": 259,
      "optional": 75,
      "peer": 0,
      "peerOptional": 0,
      "total": 478
    }
  }
}