Skip to content
Section C · The archive · Dispatch
← The archive

vulnerability · Tue 29 Sep 2026 · 23:54 UTC

GHSA-m8vh-jmq9-5rjg: Nest: Remote process termination via a deeply nested microservice message pattern

Filed UTCSource GTH ↗

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | >= 12.0.0, { // Nest's TCP framing is # socket.write(${Buffer.byteLength(payload)}#${payload}); }); ` The service exits with RangeError: Maximum call stack size exceeded. The equivalent payload published to the consumed queue crashes a RabbitMQ-transport service. ### Patches Fixed in 12.0.2 and 11.2.4. - Incoming patterns are converted through a guarded Server#getPatternAsString`, which falls back to a sentinel value that matches no handler. …

Signals

as the pipeline stamped them
High
High-risk vulnerability — CVSS 7.5

CVE

KEV from CISA · EPSS from FIRST
CVE ids in this dispatch with their KEV status and EPSS score
IdKEVEPSSReference
CVE-2026-102281—0.38%NVD ↗

Get the next one first.

Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.