fkie_cve-2026-102281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.

GHSA-m8vh-jmq9-5rjg — Nest: Remote process termination via a deeply nested microservice message pattern

Affected: npm: @nestjs/microservices

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/microservices` | | Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` | | Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) |

### Summary

A single message whose `pattern` is a deeply nested object terminates a NestJS microservice that uses the TCP or RabbitMQ transport. The server serialized the client-supplied pattern with `JSON.stringify` to derive the handler lookup key; on deeply nested input this throws `RangeError: Maximum call stack size exceeded`. The exception escaped the asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the default `--unhandled-rejections=throw`.

### Impact

Denial of service, one message per crash, repeatable. The attacker needs to be able to reach the transport: connect to the TCP transport's port, or publish to the queue or exchange the service consumes from. The TCP transport performs no authentication by default, so on a reachable port this requires nothing else.

Only the **TCP** and **RabbitMQ** transports are affected. The other transports take the pattern as a string from the broker topic or channel and never serialize a client-supplied object to build it.

### Details

In `ServerTCP#handleMessage` and `ServerRMQ#handleMessage` the pattern was stringified without a guard:

```ts const pattern = isString(packet.pattern) ? packet.pattern : JSON.stringify(packet.pattern); ```

`…

Most recent entries from all

fkie_cve-2026-102281

GHSA-m8vh-jmq9-5rjg — Nest: Remote process termination via a deeply nested microservice message pattern