vulnerability · Tue 29 Sep 2026 · 23:54 UTC
GHSA-m8vh-jmq9-5rjg: Nest: Remote process termination via a deeply nested microservice message pattern
Filed UTCSource GTH ↗
| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | >= 12.0.0, { // Nest's TCP framing is # socket.write(${Buffer.byteLength(payload)}#${payload}); }); ` The service exits with RangeError: Maximum call stack size exceeded. The equivalent payload published to the consumed queue crashes a RabbitMQ-transport service. ### Patches Fixed in 12.0.2 and 11.2.4. - Incoming patterns are converted through a guarded Server#getPatternAsString`, which falls back to a sentinel value that matches no handler. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability — CVSS 7.5
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-102281 | — | 0.38% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.