CVE-2026-35515: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35515 is a Server-Sent Events (SSE) injection vulnerability in the NestJS framework (@nestjs/core) caused by improper neutralization of newline characters in SSE protocol output. The SseStream._transform() method interpolates message.type and message.id directly into SSE text output without sanitizing \r or \n characters, enabling injection of arbitrary SSE events. All versions up to and including 11.1.17 are affected; the fix was released in version 11.1.18. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component — Injection). The SSE protocol uses \r and \n as field delimiters and \n\n as event boundaries; because SseStream._transform() does not strip or encode these characters from the type and id fields of SSE messages, an attacker who can influence upstream data sources mapped to these fields can inject crafted newline sequences into the SSE stream. Exploitation requires a precondition: developer code must bridge user-influenced data into the type or id fields of SSE messages — direct HTTP request input does not reach these fields automatically. A comparable vulnerability was previously patched in Spring Framework (commit 6e97587) for the same SSE fields (GitHub Advisory).

Successful exploitation enables three primary attack outcomes: (1) event spoofing, where an attacker forges SSE events with arbitrary event: types, causing client-side EventSource.addEventListener() callbacks to fire incorrectly; (2) data injection, where arbitrary data: payloads are injected, potentially triggering cross-site scripting (XSS) if the client renders SSE data as HTML without sanitization; and (3) reconnection state corruption, where injected id: fields corrupt the Last-Event-ID header on reconnection, causing clients to miss or replay events. The scope is changed (affecting the client browser environment), with low confidentiality and low availability impact (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-35515. The EPSS score is very low at approximately 0.015%, reflecting limited current exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific precondition — attacker-controlled data must be routed by developer code into the type or id fields of SSE messages — which limits the attack surface compared to fully unauthenticated, direct-input vulnerabilities (GitHub Advisory).

1. Identify target: Locate a NestJS application (version ≤ 11.1.17) that exposes an SSE endpoint and maps user-influenced data (e.g., from a database, external API, or user input) into the type or id fields of SSE messages.
2. Craft malicious input: Prepare a payload containing newline characters (\r, \n, or \n\n) embedded in a value that will be stored or passed as the SSE type or id field. For example, a database entry with value legit\nevent: spoofed\ndata: <script>alert(1)</script>\n\n.
3. Trigger SSE stream: Connect to the target SSE endpoint as a client (e.g., using EventSource in a browser or curl) to receive the event stream.
4. Observe injected events: The malicious newline sequences cause the SSE stream to include forged event boundaries, injecting arbitrary event:, data:, or id: fields into the stream received by connected clients.
5. Achieve objective: Depending on client-side handling — trigger wrong EventSource callbacks (event spoofing), deliver XSS payloads if SSE data is rendered as HTML, or corrupt Last-Event-ID to manipulate reconnection behavior (GitHub Advisory).

• Network: SSE responses containing unexpected additional event:, data:, or id: fields beyond what the application is designed to emit; SSE streams with embedded \r\n sequences in field values rather than only between fields.
• Logs: Application logs showing unusual or unexpected values in SSE type or id fields, particularly those containing URL-encoded or raw newline characters (%0a, %0d, \n, \r).
• Application Behavior: Client-side EventSource listeners firing for event types not defined by the application; clients experiencing unexpected reconnection behavior or replaying events due to corrupted Last-Event-ID headers.

Upgrade @nestjs/core to version 11.1.18 or later, which patches SseStream._transform() to sanitize newline characters from the type and id fields before writing them to SSE output. As a workaround prior to patching, developers should sanitize or reject any user-influenced data before mapping it to SSE type or id fields in their application code, stripping or encoding \r and \n characters. Additionally, client-side applications consuming SSE data should avoid rendering data: payloads as raw HTML to prevent XSS exploitation (GitHub Advisory).

The vulnerability was reported by security researcher aleister1102 and published as a GitHub Security Advisory (GHSA-36xv-jgw5-4q75) by NestJS maintainer kamilmysliwiec on April 3, 2026. The advisory notes a parallel with Spring Framework's own security patch (commit 6e97587) that addressed the same SSE field injection issue, lending credibility to the vulnerability class. No significant broader media coverage or social media discussion has been identified beyond standard vulnerability database aggregation (GitHub Advisory).