Skip to content
OpenAdvisories

Package · npm

@nestjs/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-35515

    @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

    Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n).…

    nestjs nest @nestjs/core npm