Executive brief
NestJS Core is a popular backend framework for building scalable Node.js applications. The framework's Server-Sent Events (SSE) implementation fails to filter special characters, allowing an attacker who can control message type or ID fields to inject malicious SSE events. This could lead to forged events reaching client applications, potential XSS attacks if clients render SSE data unsanitized, and disruption of client-side event reconnection logic. The vulnerability only affects applications that expose user-controlled data in these specific SSE fields.
Technical details
The vulnerability is an improper neutralization of special elements in output (CWE-74 / injection). The SseStream._transform() method in @nestjs/core directly interpolates the message.type and message.id fields into SSE protocol output without sanitizing carriage return (\r) and newline (\n) characters. Since the SSE protocol uses \r and \n as field delimiters and \n\n as event boundaries, an attacker can inject arbitrary SSE events and corrupt protocol state. Attack precondition: developer code must explicitly map user-influenced data to the type or id fields of SSE messages; direct HTTP input does not reach these fields without application-layer bridging. An attacker can spoof SSE event types to trigger incorrect client-side callbacks, inject arbitrary data payloads (potential XSS vector), or inject id fields to corrupt Last-Event-ID headers and cause event replay/loss. The vulnerability is patched in @nestjs/core version 11.1.18 by sanitizing newline characters; Spring Framework addressed the same issue with similar validation.
Affected products
- NestJS @nestjs/core <= 11.1.17
Timeline
- 2026-04-03: disclosed
- 2026-04-03: patched: Fixed in @nestjs/core@11.1.18
- 2026-04-06: advisory