NestJS interpolates message.type and message.id directly into Server-Sent Events text protocol output without stripping newline characters. The SSE protocol interprets carriage return and line feed as field delimiters and consecutive line feeds as event boundaries. An attacker who can influence these fields can therefore inject arbitrary SSE events, spoof event types, and corrupt the reconnection state sent to downstream clients. This exploit allows the attacker to send malicious event data to browsers or other consumers of the stream, potentially leading to data manipulation or unintended application behavior.

NestJS framework versions prior to 11.1.18 are affected. The vulnerability was discovered in the nestjs:nest product. Any application using these versions without applying the 11.1.18 update or higher is vulnerable.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than one percent suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires an attacker to inject newline characters via the message.type or message.id fields, implying that the threat vector is upstream data manipulation, such as through a crafted request or injected content in the message pipeline. When successful, the attacker can inject custom SSE events and potentially undermine client trust or cause unintended data flow.