Skip to content

fix(deps): update dependency @nestjs/core to v11.1.18 [security]#868

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nestjs-core-vulnerability
Open

fix(deps): update dependency @nestjs/core to v11.1.18 [security]#868
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-nestjs-core-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 6, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@nestjs/core (source) 11.1.3 → 11.1.18 age confidence

@​nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

CVE-2026-35515 / GHSA-36xv-jgw5-4q75

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. Spring Framework's own security patch (6e97587) validates these same fields (id, event) for the same reason.

Actual impact:

  • Event spoofing: Attacker forges SSE events with arbitrary event: types, causing client-side EventSource.addEventListener() callbacks to fire for wrong event types.
  • Data injection: Attacker injects arbitrary data: payloads, potentially triggering XSS if the client renders SSE data as HTML without sanitization.
  • Reconnection corruption: Attacker injects id: fields, corrupting the Last-Event-ID header on reconnection, causing the client to miss or replay events.
  • Attack precondition: Requires the developer to map user-influenced data to the type or id fields of SSE messages. Direct HTTP request input does not reach these fields without developer code bridging the gap.
Patches

Has the problem been patched? What versions should users upgrade to?

Patched in @nestjs/core@11.1.18

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nestjs/nest (@​nestjs/core)

v11.1.18

Compare Source

v11.1.18 (2026-04-03)

Bug fixes
Dependencies
Committers: 6

v11.1.17

Compare Source

v11.1.17 (2026-03-16)
Enhancements
Bugs
  • platform-fastify
    • auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) cbdf737 (@​kamilmysliwiec)
Dependencies
Committers: 3

v11.1.16

Compare Source

v11.1.16 (2026-03-05)
Bug fixes
  • microservices
Dependencies
Committers: 2

v11.1.15

Compare Source

What's Changed
New Contributors

Full Changelog: nestjs/nest@v11.1.14...v11.1.15

v11.1.14

Compare Source

v11.1.14 (2026-02-17)

Bug fixes
Enhancements
Committers: 5

v11.1.13

Compare Source

v11.1.13 (2026-02-03)

Bug fixes
  • common
Enhancements
Dependencies
Committers: 6

v11.1.12

Compare Source

v11.1.12 (2026-01-15)
Bug fixes
Dependencies
Committers: 3

v11.1.11

Compare Source

v11.1.11 (2025-12-29)
Bug fixes
Dependencies
Committers: 3

v11.1.10

Compare Source

v11.1.10 (2025-12-22)
Bug fixes
Enhancements
Dependencies
Committers: 11

v11.1.9

Compare Source

v11.1.9 (2025-11-14)

Bug fixes
Enhancements
Dependencies
Committers: 4

v11.1.8

Compare Source

v11.1.7

Compare Source

v11.1.6

Compare Source

v11.1.6 (2025-08-07)

Bug fixes
Dependencies
Committers: 6

v11.1.5

Compare Source

v11.1.5 (2025-07-18)

Dependencies

v11.1.4

Compare Source

v11.1.4 (2025-07-16)

Bug fixes
Enhancements
Dependencies
Committers: 11

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 6, 2026 •
edited
Loading

⚠️ No Changeset found

Latest commit: f6cc9ee

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 6, 2026 •
edited
Loading

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.19%. Comparing base (c9a6abf) to head (f6cc9ee).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #868   +/-   ##
=======================================
  Coverage   92.19%   92.19%           
=======================================
  Files          17       17           
  Lines         397      397           
  Branches      128      137    +9     
=======================================
  Hits          366      366           
  Misses         31       31

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate Bot force-pushed the renovate/npm-nestjs-core-vulnerability branch from 8931e49 to 7defbbd Compare April 24, 2026 14:46
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/core to v11.1.18 [security] fix(deps): update dependency @nestjs/core to v11.1.18 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot deleted the renovate/npm-nestjs-core-vulnerability branch April 27, 2026 18:38
@renovate renovate Bot changed the title fix(deps): update dependency @nestjs/core to v11.1.18 [security] - autoclosed fix(deps): update dependency @nestjs/core to v11.1.18 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-nestjs-core-vulnerability branch 2 times, most recently from 7defbbd to f6cc9ee Compare April 27, 2026 22:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter