CVE-2026-35515

OVERVIEW CVE-2026-35515 is an input validation vulnerability in NestJS versions prior to 11.1.18 that affects the Server-Sent Events (SSE) Stream transformation functionality. The flaw exists in the SseStream._transform() method, which fails to sanitize newline characters in message.type and message.id fields before inserting them into SSE protocol output, potentially allowing attackers to inject malicious events and manipulate server-client communication streams. SEVERITY The vulnerability carries a CVSS v3.1 base score of 6.1 (MEDIUM) with a network attack vector, low complexity, and no privilege requirements. The primary impacts include information disclosure and availability disruption, though the attack requires user interaction. The relatively high attack surface and cross-site implications (reflected in the Changed Scope rating) elevate practical risk, particularly in multi-tenant environments where SSE streams transmit user-influenced data. EXPLOITATION STATUS Currently, this vulnerability shows minimal active exploitation activity. No public exploit code is documented in the CISA Known Exploited Vulnerabilities catalog, and community attention remains limited based on the inactive Hot List status. The extremely low EPSS score of 0.00012 indicates exploitation in the wild is negligible at this time, though the vulnerability should still be prioritized given the straightforward attack mechanism and availability of patched versions.