NestJS versions before 11.1.18 contain an injection vulnerability (CWE-74) in the SseStream._transform() function. This function outputs Server-Sent Events text protocol data by directly embedding message.type and message.id without sanitizing newline characters (\r, \n). Because the SSE protocol uses these characters as delimiters and event boundaries, an attacker able to influence these fields can inject arbitrary SSE events, spoof event types, and corrupt client reconnection states. This vulnerability is addressed in version 11.1.18 of NestJS.

An attacker who can influence the message.type or message.id fields in SSE streams can inject arbitrary SSE events. This may lead to spoofed event types and corrupted reconnection states in clients consuming the SSE stream. The vulnerability does not require privileges or user interaction but does require the ability to control upstream data. There are no known exploits in the wild at this time.

Upgrade NestJS to version 11.1.18 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 11.1.18, applying this official fix is the recommended remediation. No additional mitigations are specified.