chore(deps): update dependency @nestjs/core to v11.1.18 [security]#1368

Open

renovate[bot] wants to merge 1 commit intomainfrom

renovate/npm-nestjs-core-vulnerability

Contributor

renovate bot commented Apr 7, 2026 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Confidence
@nestjs/core (source)	`11.0.20` → `11.1.18`

GitHub Vulnerability Alerts

CVE-2026-35515

Impact

What kind of vulnerability is it? Who is impacted?

SseStream._transform() interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters (\r, \n). Since the SSE protocol treats both \r and \n as field delimiters and \n\n as event boundaries, an attacker who can influence these fields through upstream data sources can inject arbitrary SSE events, spoof event types, and corrupt reconnection state. Spring Framework's own security patch (6e97587) validates these same fields (id, event) for the same reason.

Actual impact:

Event spoofing: Attacker forges SSE events with arbitrary event: types, causing client-side EventSource.addEventListener() callbacks to fire for wrong event types.
Data injection: Attacker injects arbitrary data: payloads, potentially triggering XSS if the client renders SSE data as HTML without sanitization.
Reconnection corruption: Attacker injects id: fields, corrupting the Last-Event-ID header on reconnection, causing the client to miss or replay events.
Attack precondition: Requires the developer to map user-influenced data to the type or id fields of SSE messages. Direct HTTP request input does not reach these fields without developer code bridging the gap.

Patches

Has the problem been patched? What versions should users upgrade to?

Patched in @nestjs/core@11.1.18

Release Notes

nestjs/nest (@nestjs/core)

`v11.1.18`

v11.1.18 (2026-04-03)

Bug fixes

microservices
- #16675 fix(microservices): preserve packet headers in nats serializer (@wwenrr)
core
- #16683 fix(core): prevent injector hang when design:paramtypes is missing (@Youmoo)
- #16637 fix(core): dependency injection edge case with moduleref.create (@JakobStaudinger)
- #16686 fix(core): sanitize sse message

Dependencies

core, platform-express, platform-fastify
- #16679 fix(deps): update dependency path-to-regexp to v8.4.2 (@renovate[bot])
platform-fastify
- #16623 fix(deps): update dependency fastify to v5.8.4 (@renovate[bot])
platform-ws
- #16618 chore(deps): bump ws from 8.19.0 to 8.20.0 (@dependabot[bot])
common
- #16619 chore(deps): bump file-type from 21.3.3 to 21.3.4 (@dependabot[bot])

Committers: 6

Ankit San (@ankitbelal)
Jakob Staudinger (@JakobStaudinger)
Kamil Mysliwiec (@kamilmysliwiec)
Krishna Chaitanya (@Krishnachaitanyakc)
MK (@wwenrr)
youmoo (@Youmoo)

`v11.1.17`

v11.1.17 (2026-03-16)

Enhancements

microservices
- #16218 feat(microservices): add redis driver identification (@vchomakov)

Bugs

platform-fastify
- auto-run middleware for HEAD requests as fastify redirects them to GET handlers (effectively skipping middleware execution) cbdf737 (@kamilmysliwiec)

Dependencies

common
- #16567 fix(deps): update dependency file-type to v21.3.2 (@renovate[bot])
platform-fastify
- #16533 fix(deps): update dependency fastify to v5.8.2 (@renovate[bot])

Committers: 3

Rohan Santhosh Kumar (@Rohan5commit)
Vasil Chomakov (@vchomakov)
Kamil Mysliwiec (@kamilmysliwiec)

`v11.1.16`

v11.1.16 (2026-03-05)

Bug fixes

microservices
- #16506 fix(microservices): fix double callback when isdisposed or err is truthy (@LhonRafaat)

Dependencies

platform-express
- #16507 fix(deps): update dependency multer to v2.1.1 (@renovate[bot])

Committers: 2

Lhon (@LhonRafaat)
Shahnoor Mujawar (@shahnoormujawar)

`v11.1.15`

What's Changed

fix(microservices): if indexOf return 0 will if will be falsy by @cuiweixie in #16401
fix(microservices): introuduce max pattern depth and object complexity by @kamilmysliwiec in #16402
chore(@nestjs/core): allow override for initializeWildcardHandlersIfE… by @StNekroman in #16468
chore(deps): update dependency @fastify/middie to v9.2.0 [security] by @renovate[bot] in #16472
fix(deps): update dependency multer to v2.1.0 [security] by @renovate[bot] in #16474

New Contributors

@cuiweixie made their first contribution in #16401
@StNekroman made their first contribution in #16468

Full Changelog: nestjs/nest@v11.1.14...v11.1.15

`v11.1.14`

v11.1.14 (2026-02-17)

Bug fixes

platform-fastify
- #16384 fix(fastify): fastify middleware bypass cve (@kamilmysliwiec)
common
- #16307 fix: logger print invalid context when no stack trace provided (@JulienDuf)

Enhancements

common
- #16314 fix(common): change requestOrigin type (@SpencerKaiser)

Committers: 5

Julien Dufresne (@JulienDuf)
Kamil Mysliwiec (@kamilmysliwiec)
Mykhailo Skrypsky (@mixator)
Spencer Kaiser (@SpencerKaiser)
조수민 (@suuuuuuminnnnnn)

`v11.1.13`

v11.1.13 (2026-02-03)

Bug fixes

common
- #16230 fix(common): Fix skipping maxArrayLength and maxStringLength option (@chojs23)

Enhancements

microservices
- #16286 feat(microservices): support per-handler qos in mqtt (@suuuuuuminnnnnn)
- #16262 Feat/microservices configurable max buffer size (@jobnow)
common
- #16202 fix(common): exclude built-in primitives from strip proto keys (@som14062005)

Dependencies

platform-fastify
- #16282 fix(deps): update dependency fastify to v5.7.4 (@renovate[bot])
platform-express
- #16241 fix(deps): update dependency cors to v2.8.6 (@renovate[bot])

Committers: 6

Lee Donghyun (@devizi0)
Mykhailo Skrypsky (@mixator)
Neo (@chojs23)
Praveen Somasundaram (@som14062005)
Ricardo Gomes (@jobnow)
조수민 (@suuuuuuminnnnnn)

`v11.1.12`

v11.1.12 (2026-01-15)

Bug fixes

common
- #16187 fix(common): regression in loading file-type under Windows OS (@iamkanguk97)

Dependencies

platform-ws
- #16161 chore(deps): bump ws from 8.18.3 to 8.19.0 (@dependabot[bot])
common
- #16155 fix(deps): update dependency file-type to v21.3.0 (@renovate[bot])
platform-fastify
- #16154 fix(deps): update dependency find-my-way to v9.4.0 (@renovate[bot])

Committers: 3

Antonio Tripodi (@Tony133)
KANGUK LEE (@iamkanguk97)
@miso-kyoungminkim

`v11.1.11`

v11.1.11 (2025-12-29)

Bug fixes

platform-fastify
- #16135 fix(platform-fastify): middie bypassing through decoded chars (@kamilmysliwiec)
core
- #16133 fix(core): add missing catch handler for forward-ref provider resolution (@coti-z)

Dependencies

platform-socket.io
- #16125 fix(deps): update dependency socket.io to v4.8.3 (@renovate[bot])
- #16114 chore(deps): bump socket.io from 4.8.1 to 4.8.2 (@dependabot[bot])
platform-fastify
- #16130 fix(deps): update dependency @fastify/static to v9 (@renovate[bot])
common
- #16127 chore(deps): bump file-type from 21.1.1 to 21.2.0 (@dependabot[bot])

Committers: 3

Himanshu Gupta (@manureja64)
Kamil Mysliwiec (@kamilmysliwiec)
coti (@coti-z)

`v11.1.10`

v11.1.10 (2025-12-22)

Bug fixes

core
- #16098 fix(core): instantiate nested transient providers in static context (@mag123c)
- #16005 fix(core): resolve all providers when using resolve() with each option (@malkovitc)
microservices
- #16072 fix(microservices): fix grpc stream method return type (@shash-hq)
common
- #16077 fix(common): resolve file-type path explicitly (@shash-hq)
- #16013 fix(common): Support fallbackToMimetype without buffer (@chenjieya)

Enhancements

common
- #16100 fix(common): improve error handling in FileTypeValidator (@malkovitc)
- #16060 feat(common): add message property to file type validator (@Jo-Minseok)
- #16079 fix: enhance ValidationPipe (@liu-jin-yi)
core
- #15721 feat(core): add Promise support for SSE handlers (@pythonjsgo)
microservices
- #15975 feat(microservices): add keepalive support for server side (@OlegStrokan)
common, core
- #15986 feat(core): add option for async logger compatibility (@mag123c)

Dependencies

platform-fastify
- #16041 fix(deps): update dependency @fastify/cors to v11.2.0 (@renovate[bot])
platform-express
- #16002 fix(deps): update dependency express to v5.2.1 (@renovate[bot])
common
- #15948 chore(deps): bump file-type from 21.1.0 to 21.1.1 (@dependabot[bot])

Committers: 11

Alexander (@pythonjsgo)
J_Coder (@Jo-Minseok)
Luke Son (@KAPUIST)
Oleh Strokan (@OlegStrokan)
Praveen Somasundaram (@som14062005)
Shashank (@shash-hq)
@chenjieya
@giorgikakauridze
@mag123c
chernomortsev evgeny (@malkovitc)
liu-jin-yi (@liu-jin-yi)

`v11.1.9`

v11.1.9 (2025-11-14)

Bug fixes

core
- #15865 fix(core): make get() throw for implicitly request-scoped trees (@JoeNutt)

Enhancements

common
- #15863 feat(common): add method options to @sse decorator (@TomerSteinberg)

Dependencies

platform-fastify
- #15899 chore(deps): bump fastify from 5.6.1 to 5.6.2 (@dependabot[bot])

Committers: 4

Rami (@JoeNutt)
Rhynel Algopera (@dev-rhynel)
Tomer Steinberg (@TomerSteinberg)
WuMingDao (@WuMingDao)

`v11.1.8`

`v11.1.7`

`v11.1.6`

v11.1.6 (2025-08-07)

Bug fixes

core
- #15504 fix(core): fix race condition in class dependency resolution from imported modules (@hajekjiri)
- #15469 fix(core): attach root inquirer for nested transient providers (@kamilmysliwiec)
microservices
- #15508 fix(microservices): report correct buffer length in exception (@kim-sung-jee)
- #15492 fix(microservices): fix kafka serilization of class instances (@LeonBiersch)

Dependencies

platform-fastify
- #15493 chore(deps): bump @fastify/cors from 11.0.1 to 11.1.0 (@dependabot[bot])

Committers: 6

Jiri Hajek (@hajekjiri)
Kamil Mysliwiec (@kamilmysliwiec)
Leon Biersch (@LeonBiersch)
Seongjee Kim (@kim-sung-jee)
@premierbell
pTr (@ptrgits)

`v11.1.5`

v11.1.5 (2025-07-18)

Dependencies

platform-express
- #15425 chore(deps): bump multer from 2.0.1 to 2.0.2 in /packages/platform-express (@dependabot[bot])

`v11.1.4`

v11.1.4 (2025-07-16)

Bug fixes

platform-fastify
- #15385 fix(testing): auto-init fastify adapter for middleware registration (@mag123c)
core, testing
- #15405 fix(core): fix race condition in class dependency resolution (@hajekjiri)
core
- #15333 fix(core): Make flattenRoutePath return a valid module (@gentunian)
microservices
- #15305 fix(microservices): Revisit RMQ pattern matching with wildcards (@getlarge)
- #15250 fix(constants): update RMQ_DEFAULT_QUEUE to an empty string (@EeeasyCode)

Enhancements

platform-fastify
- #14789 feat(fastify): add decorator for custom schema (@piotrfrankowski)
common, core, microservices, platform-express, platform-fastify, websockets
- #15386 feat: enhance introspection capabilities (@kamilmysliwiec)
core
- #15374 feat: supporting fine async storage control (@Farenheith)

Dependencies

platform-ws
- #15350 chore(deps): bump ws from 8.18.2 to 8.18.3 (@dependabot[bot])
platform-fastify
- #15278 chore(deps): bump fastify from 5.3.3 to 5.4.0 (@dependabot[bot])

Committers: 11

Alexey Filippov (@SocketSomeone)
EFIcats (@ext4cats)
Edouard Maleix (@getlarge)
JaeHo Jang (@mag123c)
Jiri Hajek (@hajekjiri)
Kamil Mysliwiec (@kamilmysliwiec)
Khan / 이창민 (@EeeasyCode)
Peter F. (@piotrfrankowski)
Sebastian (@gentunian)
Thiago Oliveira Santos (@Farenheith)
jochong (@jochongs)

`v11.1.3`

v11.1.3 (2025-06-06)

Bug fixes

core
- #15201 fix(core): gracefully shutdown the app when repl exits (@dzhlobo)

Enhancements

common
- #15209 feat: add string array type to disposition (@fjodor-rybakov)
common, core
- #15203 feat(core): defer initialization connected microservice (@isaryy)

Dependencies

platform-express
- #15232 chore(deps): bump multer from 2.0.0 to 2.0.1 (@dependabot[bot])

Committers: 3

Dmitry Zhlobo (@dzhlobo)
@fjodor-rybakov
@isaryy

`v11.1.2`

v11.1.2 (2025-05-26)

Bug fixes

microservices
- #15172 fix(microservices): support custom strategy in async usefactory config (@mag123c)
- #15166 fix(microservice): prevent error logs during redis client shutdown (@janroker)

Dependencies

common
- #15185 chore(deps): bump file-type from 20.5.0 to 21.0.0 (@dependabot[bot])
platform-express
- #15159 chore(deps): bump multer from 1.4.5-lts.2 to 2.0.0 (@dependabot[bot])

Committers: 2

JaeHo Jang (@mag123c)
Jan Roček (@janroker)

`v11.1.1`

v11.1.1 (2025-05-14)

Bug fixes

core
- #15056 fix(core): HTTP adapter error mapping (@maxbronnikov10)
microservices
- #15062 fix(microservices): ensure all redis and amqp client closes properly (@yatin166)
- #15032 fix(microservices): ensure all the amqp connections are closed properly (@yatin166)
- #15020 fix(microservices): ensure all redis connections are closed (@yatin166)
core, platform-fastify
- #15061 fix(core): bring back getHeader and appendHeader methods from AbstractHttpAdapter (@micalevisk)
platform-express
- #15010 feat: remove use of pipeline (@jmcdo29)

Enhancements

microservices
- #14606 feat(microservices): add specific transport id to microservices (@maxbronnikov10)
- #15057 feat(microservices): Allow custom exchangeType as string for plugin compatibility (@ChangmoKang)
- #15072 feat(microservices): Add exchange arguments to RabbitMQ (@gapon2401)

Dependencies

platform-fastify
- #15129 chore(deps): bump fastify from 5.3.2 to 5.3.3 (@dependabot[bot])
platform-ws
- #15068 chore(deps): bump ws from 8.18.1 to 8.18.2 (@dependabot[bot])
common
- #15029 chore(deps): bump file-type from 20.4.1 to 20.5.0 (@dependabot[bot])

Committers: 7

Antonio Tripodi (@Tony133)
Changmo Kang (Ryan) (@ChangmoKang)
Igor Gaponov (@gapon2401)
Jackie McDoniel (@jmcdo29)
Maxim Bronnikov (@maxbronnikov10)
Micael Levi L. Cavalcante (@micalevisk)
Yatin Gaikwad (@yatin166)

`v11.1.0`

v11.1.0 (2025-04-23)

Enhancements

microservices
- #14540 feat(microservices): add support for topic exchange (rabbitmq) (@kamilmysliwiec)

Committers: 1

Kamil Mysliwiec (@kamilmysliwiec)

`v11.0.21`

v11.0.21 (2025-04-23)

Enhancements

common
- #14995 feat(common): Add fallbackToMimetype support in FileTypeValidator (@mag123c)

Dependencies

platform-fastify
- #14989 fix(deps): update dependency fastify to v5.3.2 [security] (@renovate[bot])

Committers: 1

JaeHo Jang (@mag123c)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          chore(deps): update dependency @nestjs/core to v11.1.18 [security]

f414660

renovate bot requested review from a team as code owners

April 7, 2026 00:27

renovate-approve bot approved these changes

View reviewed changes

renovate-approve-2 bot approved these changes

View reviewed changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet