@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...

PT-2026-30760

Impact What kind of vulnerability is it? Who is impacted? SseStream. transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters r, . Since the SSE protocol treats both r and as field delimiters and as event...