CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

What is CVE-2026-35515?

CVE-2026-35515 is a medium-severity vulnerability in nestjs nest, published on 7 Apr 2026.

Official description

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.

Weakness: CWE-74

Which versions are affected by CVE-2026-35515?

2 open source packages ship an affected version, including @nestjs/core. It affects 1 product.

Products include Nestjs Nest.

How do I fix CVE-2026-35515?

Upgrade @nestjs/core to 11.1.18 or later.

Is CVE-2026-35515 being exploited?

There is no known exploitation of CVE-2026-35515 in the wild and no public exploit code.

Other vulnerabilities in nestjs nest

• CVE-2026-33011 Nest Fastify HEAD Request Middleware Bypass High 8.7
• CVE-2026-2293 NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass High 8.2
• CVE-2026-40879 Nest: DoS via Recursive handleData in JsonSocket (TCP Transport) High 7.5
• CVE-2025-69211 Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) Medium 6.9
• CVE-2024-29409 nest allows a remote attacker to execute arbitrary code via the Content-Type header Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-36xv-jgw5-4q75, ROOT-APP-NPM-CVE-2026-35515.