{"id":"EUVD-2026-24264","enisaUuid":"00aec19b-3ac6-35ef-b4c0-8f001d2f3bbb","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","datePublished":"Apr 21, 2026, 7:14:17 PM","dateUpdated":"Apr 21, 2026, 7:38:04 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm\n","aliases":"CVE-2026-40879\nGHSA-hpwf-8g29-85qm\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"f7e8dd8d-38de-39ac-8e83-e8c0beb000b2","product":{"name":"nest","vendor":{"name":"nestjs"}},"product_version":"\u003c 11.1.19"}],"enisaIdVendor":[{"id":"7c3c05e0-d5b7-3ea1-b212-2a15ad1ca435","vendor":{"name":"nestjs"}}],"enisaIdVulnerability":[{"id":"603b1a29-5ff7-39bb-ac19-50a89fc9ad0b","vulnerability":{"id":"GHSA-hpwf-8g29-85qm","description":"Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)","datePublished":"Apr 14, 2026, 12:15:09 AM","dateUpdated":"Apr 27, 2026, 4:16:57 PM","baseScore":0.0,"references":"https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40879\nhttps://github.com/nestjs/nest\n","enisa_id":"EUVD-2026-24264\n","aliases":"CVE-2026-40879\nGHSA-hpwf-8g29-85qm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7eddb5d2-ed29-3961-872f-0968c9829ec4","vulnerability":{"id":"CVE-2026-40879","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","datePublished":"Apr 21, 2026, 7:14:17 PM","dateUpdated":"Apr 21, 2026, 7:38:04 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm\n","enisa_id":"EUVD-2026-24264\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"1428aabd-9776-3156-abe7-6c1320b1ceaa","product":{"name":"nest","vendor":{"name":"nestjs"}},"product_version":"\u003c 11.1.19"}],"vulnerabilityVendor":[{"id":"bbae55f1-93f9-3197-a764-28da38e5798a","vendor":{"name":"nestjs"}}]}}],"enisaIdAdvisory":[]}