Skip to content
OpenAdvisories

Package · npm

@nestjs/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.3
    CVE-2026-35515

    @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n).…

    nestjs nest @nestjs/core npm
  • Low 3.7
    CVE-2023-26108

    @nestjs/core vulnerable to Information Exposure via StreamableFile pipe

    Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the…

    @nestjs/core npm