Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-35515@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Medium 6.3

In plain English

A medium-severity injection in nest from nestjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nestjs/core	11.1.18	GHSA-36xv-jgw5-4q75

Affected products (as reported)

Vendor	Product	Versions
nestjs	nest	< 11.1.18

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N

References

https://github.com/nestjs/nest/security/advisories/GHSA-36xv-jgw5-4q75 x_refsource_CONFIRM