nestjs @nestjs/core vulnerabilities

Latest nestjs @nestjs/core CVEs

Newest publication first

1. CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

   Published 2026-04-07

   Medium·CVSS 6.3 EPSS 0.24%

   Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protoc...

2. CVE-2023-26108 @nestjs/core vulnerable to Information Exposure via StreamableFile pipe

   Published 2023-03-06

   Medium·CVSS 5.3 EPSS 0.71%

   Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.