CVE-2026-35515 PUBLISHED

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Assigner: GitHub_M
Reserved: 03.04.2026 Published: 07.04.2026 Updated: 07.04.2026

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N
CVSS Score: 6.3

Product Status

Vendor nestjs
Product nest
Versions
  • Version < 11.1.18 is affected

References

Problem Types

  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE