Executive Summary
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. This vulnerability is fixed in 11.1.18.
Quantitative Risk Analysis
OsVault Risk Score Methodology
The OsVault composite score is a 5-layer non-linear engine — not a simple weighted average. Each input signal is transformed through mathematically appropriate curves before blending, ensuring that exploitability context overrides raw severity when warranted.
Layer 1 (Technical): CVSS is mapped through a piecewise exponential curve with 4 bands (LOW 0–20, MEDIUM 20–55, HIGH 55–85, CRITICAL 85–100), then multiplied by full CVSS vector decomposition factors for Attack Vector, Complexity, Privileges, and User Interaction.
Layer 2 (Threat): Raw EPSS is passed through a logistic sigmoid (k=40, midpoint=0.05) to maximize discrimination in the decision-relevant range. The result is added to an exploit maturity tier base score (Weaponized: 85, Functional: 55, PoC: 40, Unproven: 18).
Layer 3 (KEV Floor):Any CVE in CISA's catalog receives a hard minimum of 93.0 (Functional) or 97.0 (Weaponized). This ensures confirmed exploitation is never buried by low CVSS scores.
Scores ≥70: patch immediately. 40–69: schedule within current sprint. Below 40: standard maintenance cycle.
Remediation Commands
Commands to update each affected package identified in this advisory. Verify the target release explicitly addresses this CVE in the upstream changelog before deploying to production.
npm install @nestjs/core@latest