# CVE-2026-35515: @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Source: https://junglewise.ai/threats/cve-2026-35515-nestjs-core-improperly-neutralizes-special-elements-in-output  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-35515 · Severity: medium · CVSS 6.1 · Published 2026-04-07

NestJS Core is a popular backend framework for building scalable Node.js applications. The framework's Server-Sent Events (SSE) implementation fails to filter special characters, allowing an attacker who can control message type or ID fields to inject malicious SSE events. This could lead to forged events reaching client applications, potential XSS attacks if clients render SSE data unsanitized, and disruption of client-side event reconnection logic. The vulnerability only affects applications that expose user-controlled data in these specific SSE fields.

Technologies: [NestJS Nest](https://junglewise.ai/threats/technologies/nest). Vendors: [NestJS](https://junglewise.ai/threats/vendors/nestjs), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-35515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35515 being exploited in the wild.

**How severe is CVE-2026-35515?** Medium severity, with a CVSS score of 6.1, published 7 April 2026.

**Which products and versions are affected?** @nestjs/core (npm) <= 11.1.17, SEMVER:introduced=0,fixed=11.1.18.

**Is there a fix for CVE-2026-35515?** Yes. @nestjs/core (npm): upgrade to 11.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35515 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-35515?** Check whether you run NestJS Nest or @nestjs/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nestjs/core (npm): upgrade to 11.1.18 or later

  ```sh
  npm install @nestjs/core@11.1.18
  ```


## Technical details

The vulnerability is an improper neutralization of special elements in output (CWE-74 / injection). The SseStream._transform() method in @nestjs/core directly interpolates the message.type and message.id fields into SSE protocol output without sanitizing carriage return (\r) and newline (\n) characters. Since the SSE protocol uses \r and \n as field delimiters and \n\n as event boundaries, an attacker can inject arbitrary SSE events and corrupt protocol state. Attack precondition: developer code must explicitly map user-influenced data to the type or id fields of SSE messages; direct HTTP input does not reach these fields without application-layer bridging. An attacker can spoof SSE event types to trigger incorrect client-side callbacks, inject arbitrary data payloads (potential XSS vector), or inject id fields to corrupt Last-Event-ID headers and cause event replay/loss. The vulnerability is patched in @nestjs/core version 11.1.18 by sanitizing newline characters; Spring Framework addressed the same issue with similar validation.

## Affected products

- NestJS @nestjs/core <= 11.1.17

## Identifiers

- CVE-2026-35515
- GHSA-36xv-jgw5-4q75

## Timeline

- 2026-04-03: disclosed
- 2026-04-03: patched: Fixed in @nestjs/core@11.1.18
- 2026-04-06: advisory

## References

- [https://github.com/nestjs/nest/security/advisories/GHSA-36xv-jgw5-4q75](https://github.com/nestjs/nest/security/advisories/GHSA-36xv-jgw5-4q75)
- [https://github.com/nestjs/nest/pull/16686](https://github.com/nestjs/nest/pull/16686)
- [https://github.com/nestjs/nest/commit/83558ae774a990a7916141d3abe0b6548ff3a8b2](https://github.com/nestjs/nest/commit/83558ae774a990a7916141d3abe0b6548ff3a8b2)
- [https://github.com/nestjs/nest](https://github.com/nestjs/nest)
- [https://github.com/nestjs/nest/releases/tag/v11.1.18](https://github.com/nestjs/nest/releases/tag/v11.1.18)

## Related threats

- [NestJS denial of service via deeply nested microservice message pattern](https://junglewise.ai/threats/cve-2026-102281-nest-is-a-framework-for-building-scalable-node-js-server-side)
- [NestJS authentication bypass in @nestjs/platform-fastify via trailing slash](https://junglewise.ai/threats/cve-2026-54281-nestjs-authentication-bypass-in-nestjs-platform-fastify-via)
- [Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)](https://junglewise.ai/threats/cve-2026-40879-nest-affected-by-dos-via-recursive-handledata-in-jsonsocket-tcp)
- [NestJS auth bypass in @nestjs/platform-fastify](https://junglewise.ai/threats/cve-2026-2293-nestjs-auth-bypass-in-nestjs-platform-fastify)
- [NestJS Fastify URL encoding middleware bypass](https://junglewise.ai/threats/cve-2025-69211-nestjs-fastify-url-encoding-middleware-bypass)