CLSA-2026-1792161499 TuxCare security update for @nestjs/core (1 CVE)

TuxCare rebuilt @nestjs/core to address 1 CVE. Fixed in 11.2.4-tuxcare.1...

CLSA-2026-1792161498 TuxCare security update for @nestjs/core (2 CVEs)

TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 11.2.3-tuxcare.1...

CLSA-2026-1792161497 TuxCare security update for @nestjs/core (1 CVE)

TuxCare rebuilt @nestjs/core to address 1 CVE. Fixed in 10.4.22-tuxcare.3...

CLSA-2026-1792161496 TuxCare security update for @nestjs/core (2 CVEs)

TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 10.4.22-tuxcare.1...

CLSA-2026-1792160938 TuxCare security update for @nestjs/core (2 CVEs)

TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 11.2.2-tuxcare.1...

PT-2026-124113

TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 10.4.22-tuxcare.1...

PT-2026-124115

TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 11.2.3-tuxcare.1...

PT-2026-124116

TuxCare rebuilt @nestjs/core to address 1 CVE. Fixed in 11.2.4-tuxcare.1...

PT-2026-124114

TuxCare rebuilt @nestjs/core to address 1 CVE. Fixed in 10.4.22-tuxcare.3...

PT-2026-123674

TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 11.2.2-tuxcare.1...

ROOT-APP-NPM-CVE-2026-35515 CVE-2026-35515 in @nestjs/core - Patched by Root

Root has patched CVE-2026-35515 in the @nestjs/core package for Root:npm. Multiple fixed versions available...

Injection

@nestjs/core is vulnerable to Injection. The vulnerability is due to unsanitized interpolation of user-controlled fields into Server-Sent Events output, which allows an attacker to inject arbitrary events, spoof event types, and manipulate the event stream...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +5525 more potentially affected by CVE-2026-35515 via @nestjs/core (>=3.0.1, <=11.1.17)

@nestjs/core NPM version =3.0.1, =0.0.1, =0.0.1-alpha.0, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =1.0.0, =1.3.4, =0.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.1 and more Source cves: CVE-2026-35515 Source advisory: MEND:CVE-2026-35515...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +89 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: OSV:GHSA-36XV-JGW5-4Q75...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +89 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: GHSA-36XV-JGW5-4Q75...

GHSA-36XV-JGW5-4Q75 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +89 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: SNYK:JS-NESTJSCORE-15920868...

Always-Incorrect Control Flow Implementation

Overview @nestjs/core is a Nest - modern, fast, powerful node.js web framework @core Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation when handling a @nestjs/platform-fastify HEAD request. An attacker can bypass middleware logic by sending malicious...