Packages / @nestjs/microservices / Security

HighVulnerabilityGHSA-hpwf-8g29-85qmCVE-2026-40879Published 14 Apr 2026

Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)

Affected releases · @nestjs/microservices

  • 11.x11.0.0 – 11.1.18Fixed in 11.1.19
  • 10.x10.0.0 – 10.4.22No fix on this line yet
  • 9.x and older2.0.0 – 9.4.3No fix, no longer updated

On 11.x, the newest line:

npm install @nestjs/microservices@11.1.19
12.x

  1. Not affected

    12.0.0 – 12.2.0

    10 releases, latest

11.x

  1. Affected

    11.0.0 – 11.1.18

    41 releases

  2. Fixed

    11.1.19 – 11.2.7

    19 releases

10.x

  1. Affected

    10.0.0 – 10.4.22

    55 releases

9.x

  1. Affected

    9.0.0 – 9.4.3

    37 releases

8.x

  1. Affected

    8.0.0 – 8.4.7

    32 releases

7.x

  1. Affected

    7.0.0 – 7.6.18

    51 releases

6.x

  1. Affected

    6.0.0 – 6.11.11

    67 releases

5.x

  1. Affected

    5.0.0 – 5.7.4

    30 releases

4.x

  1. Affected

    4.0.0 – 4.6.6

    37 releases

3.x

  1. Affected

    3.0.0 – 3.1.0

    4 releases

2.x

  1. Affected

    2.0.0 – 2.1.0

    9 releases

392 stable releases of @nestjs/microservices, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @nestjs/microservices. It is read in your browser and sent nowhere.

What happens

Impact

Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError

Patches

Fixed in @nestjs/microservices@11.1.19

References

Discovered by github.com/hwpark6804-gif