ROOT-APP-NPM-CVE-2026-35515 CVE-2026-35515 in @nestjs/core - Patched by Root

Root has patched CVE-2026-35515 in the @nestjs/core package for Root:npm. Multiple fixed versions available...

Injection

@nestjs/core is vulnerable to Injection. The vulnerability is due to unsanitized interpolation of user-controlled fields into Server-Sent Events output, which allows an attacker to inject arbitrary events, spoof event types, and manipulate the event stream...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

GHSA-36XV-JGW5-4Q75 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +88 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: OSV:GHSA-36XV-JGW5-4Q75...

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +88 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: SNYK:JS-NESTJSCORE-15920868...

Always-Incorrect Control Flow Implementation

Overview @nestjs/core is a Nest - modern, fast, powerful node.js web framework @core Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation when handling a @nestjs/platform-fastify HEAD request. An attacker can bypass middleware logic by sending malicious...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +87 more potentially affected by CVE-2026-33011 via @nestjs/core (>=11.0.0, <=11.1.16)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-33011 Source advisory: SNYK:JS-NESTJSCORE-15682556...

@ama-sdk/create (>=14.1.0-prerelease.11, <=14.1.0-prerelease.39), @gen-epix/generate-api (0.0.19) +21 more potentially affected by CVE-2026-2293 via @nestjs/core (11.1.13)

@nestjs/core NPM version 11.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/core and may be impacted: - @ama-sdk/create =14.1.0-prerelease.11, =1.0.41, =1.2.0, =1.2.1, =11.14.0, =2.28.1, =0.1.1, =0.15.1 and more Source cves: CVE-2026-2293...

Incorrect Authorization

Overview @nestjs/core is a Nest - modern, fast, powerful node.js web framework @core Affected versions of this package are vulnerable to Incorrect Authorization when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. An attacke...

CVE-2023-26108

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

Open redirect

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open...

PT-2023-20495 · Nestjs · @Nestjs/Core

Name of the Vulnerable Software and Affected Versions: @nestjs/core versions prior to 9.0.5 Description: The issue allows for Information Exposure via the StreamableFile pipe. This can be exploited when a client cancels a request while streaming a StreamableFile, resulting in the stream wrapped b...

@gleb216/fn.nestjs.core.modules (>=0.0.87, <=0.0.93), @haulsuite/livehaul-sdk (>=0.0.1, <=1.0.0) +17 more potentially affected by CVE-2023-26108 via @nestjs/core (>=9.0.0, <=9.0.4)

@nestjs/core NPM version =9.0.0, =0.0.87, =0.0.1, =0.1.0, =9.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.8, =4.49.1-test.3, =0.6.0, =0.0.13, =0.1.7, =0.4.0 - nestjs-eclih 0.0.15 and more Source cves: CVE-2023-26108 Source advisory: SNYK:JS-NESTJSCORE-2869127...

Information Exposure

Overview @nestjs/core is a Nest - modern, fast, powerful node.js web framework @core Affected versions of this package are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a...