CVE-2026-35515: Nest is a framework for building scalable Node.js server-side applications

Routine

MEDIUM 6.1UPGRADE

CVE-2026-35515 is a medium-severity flaw (CVSS 6.1) affecting nest. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary S

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.2% (top 86%)
CISA exploited list	No
Weakness	CWE-74
Published	2026-04-07
Last modified	2026-10-26

Publisher (CNA): GitHub, Inc. · Vendor: nestjs

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-04-07 16:16 UTCPublished CVE record published
2026-10-26 21:10 UTCUpdated Record last modified

nestjs nest UPGRADE

Affected: < 11.1.18

Fixed in: 11.1.18

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls nest

2. UPGRADE to 11.1.18

npm install nest@">=11.1.18"

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-35515?

nest: upgrade to 11.1.18. Exact commands for each OS are on this page.

Is CVE-2026-35515 being exploited?

CVE-2026-35515 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-35515 affect?

CVE-2026-35515 affects nest. Severity is medium (CVSS 6.1). Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline c

How urgent is CVE-2026-35515?

Priority 25/100. No elevated risk signals yet.

Software pages

Node.js vulnerabilities

Related CVEs

CVE-2026-40879 HIGH 7.5 UPGRADE Nest is a framework for building scalable Node.js server-side applications

References

← Back to latest CVEs