Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@nestjs/core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3npmAmendedPublished

    @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

    CVE-2026-35515 · GHSA-36xv-jgw5-4q75

    Affected
    • npm @nestjs/core <= 11.1.17
    Fixed in
    11.1.18· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? SseStream.transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. Spring Framework's own security patch (6e97587) validates these same fields (id, event) for the same reason. Actual impact: - Event spoofing: Attacker forges SSE events with arbitrary event: types, causing client-side EventSource.addEventListener() callbacks to fire for wrong event types. - Data injection: Attacker injects arbitrary data: payloads, potentially triggering XSS if the client renders SSE data as HTML without sanitization. - Reconnection corruption: Attacker injects id: fields, corrupting the Last-Event-ID…

    Recommended action: Upgrade to 11.1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 5.3npmAmendedPublished

    @nestjs/core vulnerable to Information Exposure via StreamableFile pipe

    CVE-2023-26108 · GHSA-4jpv-8r57-pv7j

    Affected
    • npm @nestjs/core < 9.0.5
    Fixed in
    9.0.5· Vendor fix available
    Issue
    Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

    Recommended action: Upgrade to 9.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →