6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35515

CVE-2026-35515: @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35515

CVE-2026-35515:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nestjs/core	npm	<= 11.1.17	11.1.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the SseStream._transform method within @nestjs/core. The method constructs Server-Sent Events (SSE) messages and did not properly sanitize the message.type and message.id fields. An attacker, able to control these fields, could inject newline characters (\r or \n). Since the SSE protocol uses newlines to delimit fields and events, this flaw allowed for the injection of malicious data:, event:, or id: fields. This could lead to cross-site scripting (XSS) if the client renders the data as HTML, event spoofing, or corruption of the client's reconnection state. The provided patch confirms this by adding a sanitization step that removes newline characters from these fields, directly addressing the root cause of the vulnerability. Therefore, the SseStream._transform function is the precise location of the vulnerability.

Vulnerable functions

SseStream._transform

packages/core/router/sse-stream.ts

The `_transform` method in the `SseStream` class was vulnerable to SSE injection. It directly used `message.type` and `message.id` in the SSE output without sanitizing newline characters. This allowed an attacker who could control these values to inject arbitrary SSE events, leading to potential data injection, event spoofing, and other issues. The patch introduced a `sanitize` function to strip newline characters from these fields before they are written to the output stream.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.