Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-97705 (GCVE-0-2026-97705)

Vulnerability from nvd – Published: 2026-11-04 19:28 – Updated: 2026-11-05 19:18

Title

Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

Summary

Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:18 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/moleculerjs/moleculer/security…	x_refsource_CONFIRM
https://github.com/moleculerjs/moleculer/commit/1…	x_refsource_MISC
https://github.com/moleculerjs/moleculer/commit/9…	x_refsource_MISC
https://github.com/moleculerjs/moleculer/releases…	x_refsource_MISC
https://github.com/moleculerjs/moleculer/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moleculerjs	moleculer	Affected: >= 0.15.0, < 0.15.2 Affected: < 0.14.36

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:18:32.217571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:18:45.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moleculer",
          "vendor": "moleculerjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.15.0, \u003c 0.15.2"
            },
            {
              "status": "affected",
              "version": "\u003c 0.14.36"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length \u003e 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T19:28:56.273Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2"
        }
      ],
      "source": {
        "advisory": "GHSA-h89v-g948-47vp",
        "discovery": "UNKNOWN"
      },
      "title": "Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-97705",
    "datePublished": "2026-11-04T19:28:56.273Z",
    "dateReserved": "2026-09-24T21:43:37.209Z",
    "dateUpdated": "2026-11-05T19:18:45.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-97705 (GCVE-0-2026-97705)

Vulnerability from cvelistv5 – Published: 2026-11-04 19:28 – Updated: 2026-11-05 19:18

Title

Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

Summary

Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:18 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/moleculerjs/moleculer/security…	x_refsource_CONFIRM
https://github.com/moleculerjs/moleculer/commit/1…	x_refsource_MISC
https://github.com/moleculerjs/moleculer/commit/9…	x_refsource_MISC
https://github.com/moleculerjs/moleculer/releases…	x_refsource_MISC
https://github.com/moleculerjs/moleculer/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moleculerjs	moleculer	Affected: >= 0.15.0, < 0.15.2 Affected: < 0.14.36

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:18:32.217571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:18:45.325Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moleculer",
          "vendor": "moleculerjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.15.0, \u003c 0.15.2"
            },
            {
              "status": "affected",
              "version": "\u003c 0.14.36"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length \u003e 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T19:28:56.273Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36"
        },
        {
          "name": "https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2"
        }
      ],
      "source": {
        "advisory": "GHSA-h89v-g948-47vp",
        "discovery": "UNKNOWN"
      },
      "title": "Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-97705",
    "datePublished": "2026-11-04T19:28:56.273Z",
    "dateReserved": "2026-09-24T21:43:37.209Z",
    "dateUpdated": "2026-11-05T19:18:45.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

2 vulnerabilities by moleculerjs

CVE-2026-97705 (GCVE-0-2026-97705)

CVE-2026-97705 (GCVE-0-2026-97705)