The vulnerability stems from an omission of sanitization in the SSE output handling of NestJS’s SseStream._transform() method. Newline characters and are introduced directly from message.type and message.id fields into the Server‑Sent Events protocol stream. Because the SSE specification interprets these characters as delimiters and as event boundaries, an attacker who can control these fields can inject whole SSE events, manipulate event types, and corrupt the client’s reconnection logic. This leads to arbitrary event injection and potential disruption of application state, representing an injection flaw (CWE‑74).

This issue affects the NestJS framework (nestjs:nest) in all releases prior to 11.1.18. Version 11.1.18 and later contain a patch that sanitizes the relevant fields, eliminating the injection vector.

The vulnerability has a CVSS score of 6.3, indicating a moderate severity. EPSS is not available, and it is not listed in the CISA KEV catalog, suggesting no widely known exploits at present. The attack requires an attacker who can influence the message.type or message.id values supplied to SSE streams, which may be achievable through upstream data sources. If exploited, an attacker could deliver malicious SSE events to clients, corrupt reconnection sequences, and potentially manipulate client‐side application logic. Overall, the risk is moderate, but it should be mitigated promptly to prevent future exploitation.