CVE-2022-31070: 
JavaScript vulnerability analysis and mitigation

NestJS Proxy is a NestJS module designed to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library contained a security vulnerability where sensitive cookies (e.g., session cookies) could be inadvertently forwarded to backend services configured by the application developer (NVD).

The vulnerability stems from the library's lack of cookie filtering functionality. Before version 0.7.0, there was no mechanism to prevent sensitive cookies from being automatically forwarded to backend services, which could lead to unintended exposure of sensitive authentication data (NVD).

The vulnerability could result in sensitive cookies being inadvertently exposed to backend services that should not have access to them. This could potentially compromise session security and user authentication data (NVD).

The issue has been fixed in version 0.7.0 of @finastra/nestjs-proxy. The patched version blocks cookies from being forwarded by default, with developers able to configure an allow-list of cookie names using the allowedCookies config setting. Users of @ffdc/nestjs-proxy are advised that this package has been deprecated and should update their package.json file to use @finastra/nestjs-proxy instead (NVD).