CVE-2026-35515: Nest.js Framework XSS Vulnerability

CVE-2026-35515 Overview

CVE-2026-35515 is an injection vulnerability in NestJS, a popular framework for building scalable Node.js server-side applications. The vulnerability exists in the SseStream._transform() function, which interpolates message.type and message.id directly into Server-Sent Events (SSE) text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state.

Critical Impact

Attackers can inject malicious SSE events into legitimate streams, potentially spoofing event types and corrupting client reconnection state, leading to data manipulation and denial of service scenarios.

Affected Products

• NestJS versions prior to 11.1.18

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-35515 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35515

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly referred to as an Injection vulnerability. The flaw resides in the SSE stream transformation logic within NestJS's core framework.

The Server-Sent Events protocol uses a simple text-based format where fields are delimited by newline characters and events are separated by double newlines. When the SseStream._transform() method processes SSE messages, it constructs the output by directly concatenating user-controllable values (message.type and message.id) into the protocol stream without proper sanitization.

An attacker with control over upstream data sources that populate these message fields can embed newline sequences to break out of the intended field context. This enables several attack scenarios including injection of completely fabricated SSE events, modification of the event type that client-side JavaScript handlers respond to, and manipulation of the id field which affects reconnection behavior through the Last-Event-ID header.

Root Cause

The root cause is insufficient input validation in the SseStream._transform() method. The function fails to sanitize or escape newline characters (\r and \n) in the message.type and message.id fields before incorporating them into the SSE output stream. Since these characters have special meaning in the SSE protocol as field and event delimiters, unsanitized user input containing these characters can alter the structure of the SSE output.

Attack Vector

The attack vector is network-based, requiring an attacker to control or influence data that flows into SSE message construction. This could occur through various upstream data sources such as database content, API responses, user input fields, or message queue payloads. When malicious data containing newline sequences reaches the vulnerable SseStream._transform() function, it gets interpolated directly into the SSE stream, allowing the attacker to inject arbitrary protocol content.

For example, if an attacker can inject the string legitimate\n\nevent: malicious\ndata: payload into the message.type field, the resulting SSE output would contain both the original event context and a completely new injected event that client applications would process as authentic.

Technical details and the security advisory are available at the GitHub Security Advisory.

Detection Methods for CVE-2026-35515

Indicators of Compromise

• Unexpected or malformed SSE events appearing in browser developer tools or client-side logging
• SSE streams containing multiple event: or id: fields within a single logical event
• Client applications processing events with unexpected types or corrupted identifiers
• Anomalous reconnection behavior from SSE clients due to manipulated Last-Event-ID values

Detection Strategies

• Implement server-side logging of SSE message content to identify payloads containing raw newline characters in type or id fields
• Monitor for unusual patterns in SSE traffic such as events with unexpected types or rapid reconnection attempts
• Deploy application-layer firewalls or WAF rules to detect newline injection attempts in SSE-related endpoints
• Review upstream data sources feeding into SSE streams for potential injection points

Monitoring Recommendations

• Enable verbose logging on SSE endpoints to capture the full content of messages being streamed
• Set up alerts for SSE clients experiencing abnormal reconnection patterns that could indicate id field manipulation
• Monitor application logs for errors related to malformed SSE data or unexpected event processing
• Implement integrity checks on critical data before it enters SSE message construction pipelines

How to Mitigate CVE-2026-35515

Immediate Actions Required

• Upgrade NestJS to version 11.1.18 or later immediately
• Audit applications using NestJS SSE functionality to identify exposure
• Review upstream data sources that feed into SSE message type and id fields for potential attacker influence
• Implement input validation on any user-controllable data before it reaches SSE stream processing

Patch Information

The vulnerability is fixed in NestJS version 11.1.18. The patch sanitizes newline characters in the message.type and message.id fields before they are interpolated into the SSE output stream. Upgrade to this version or later to remediate the vulnerability. For complete details, refer to the GitHub Security Advisory.

Workarounds

• Implement custom middleware to sanitize SSE message fields by stripping or encoding newline characters (\r, \n) before they reach the SSE stream handler
• Add input validation at the application layer to reject or escape data containing newline sequences destined for SSE fields
• Consider implementing a wrapper around SSE endpoints that performs explicit sanitization of event types and identifiers
• Limit SSE message field values to a strict allowlist where possible to prevent injection of arbitrary content

# Update NestJS to the patched version
npm update @nestjs/core@11.1.18
npm update @nestjs/common@11.1.18

# Verify installed version
npm list @nestjs/core