{"id":"EUVD-2026-88511","revision":null,"records":[{"revision":"4efa1fff92c345f3aa91506084ab7eb8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102281","aliases":[],"title":"Nest: Remote process termination via a deeply nested microservice message pattern","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.","state":0,"publishedAt":"2026-09-28T21:21:25.047+00:00","modifiedAt":"2026-09-29T12:50:34.126+00:00","affected":[{"ecosystem":"Vendor product","name":"nest","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nestjs\",\n                    \"product\": \"nest\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 11.2.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 12.0.0, < 12.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg","https://github.com/nestjs/nest/pull/17737","https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f","https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da","https://github.com/nestjs/nest/releases/tag/v11.2.4","https://github.com/nestjs/nest/releases/tag/v12.0.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102281","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102281","identifiers":["CVE-2026-102281"]},"retained":false,"historicalAffected":[]},{"revision":"2f81d4edccc64f72b9da165558a4d1cb","observedAt":"2026-11-11T05:29:03.753+00:00","statement":{"source":"euvd","id":"EUVD-2026-88511","aliases":["CVE-2026-102281","GHSA-m8vh-jmq9-5rjg"],"title":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. Ser…","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg","https://github.com/nestjs/nest/pull/17737","https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f","https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da","https://github.com/nestjs/nest/releases/tag/v11.2.4","https://github.com/nestjs/nest/releases/tag/v12.0.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88511","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 28, 2026, 9:21:25 PM","dateUpdated":"Sep 29, 2026, 12:50:34 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88511","identifiers":["EUVD-2026-88511","CVE-2026-102281","GHSA-m8vh-jmq9-5rjg"]},"retained":false,"historicalAffected":[]},{"revision":"f0b4c978d674403d88656a906a9596fa","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-102281","aliases":[],"title":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. Ser…","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.","state":0,"publishedAt":"2026-09-28T22:17:32.05+00:00","modifiedAt":"2026-09-30T19:56:45.443+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f","https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da","https://github.com/nestjs/nest/pull/17737","https://github.com/nestjs/nest/releases/tag/v11.2.4","https://github.com/nestjs/nest/releases/tag/v12.0.2","https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102281","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-248","CWE-674"],"productCriteria":[],"sourceDates":{"published":"2026-09-28T22:17:32.050","lastModified":"2026-09-30T19:56:45.443"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-102281","identifiers":["CVE-2026-102281"]},"retained":false,"historicalAffected":[]},{"revision":"cf65d62d641f410ebe8efa485e6c8972","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-m8vh-jmq9-5rjg","aliases":["CVE-2026-102281"],"title":"Nest: Remote process termination via a deeply nested microservice message pattern","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/microservices` |\n| Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` |\n| Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) |\n\n### Summary\n\nA single message whose `pattern` is a deeply nested object terminates a NestJS microservice that uses the TCP or\nRabbitMQ transport. The server serialized the client-supplied pattern with `JSON.stringify` to derive the handler\nlookup key; on deeply nested input this throws `RangeError: Maximum call stack size exceeded`. The exception escaped\nthe asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the\ndefault `--unhandled-rejections=throw`.\n\n### Impact\n\nDenial of service, one message per crash, repeatable. The attacker needs to be able to reach the transport: connect\nto the TCP transport's port, or publish to the queue or exchange the service consumes from. The TCP transport\nperforms no authentication by default, so on a reachable port this requires nothing else.\n\nOnly the **TCP** and **RabbitMQ** transports are affected. The other transports take the pattern as a string from the\nbroker topic or channel and never serialize a client-supplied object to build it.\n\n### Details\n\nIn `ServerTCP#handleMessage` and `ServerRMQ#handleMessage` the pattern was stringified without a guard:\n\n```ts\nconst pattern = isString(packet.pattern)\n  ? packet.pattern\n  : JSON.stringify(packet.pattern);\n```\n\n`JSON.parse` accepts nesting depths that `JSON.stringify` cannot re-serialize, because `JSON.stringify` recurses\nnatively, so an attacker can craft a payload that parses successfully on arrival and then throws when the pattern is\nconverted back to a string. Neither transport attached a rejection handler to the promise returned by\n`handleMessage`, so the `RangeError` propagated out as an unhandled rejection.\n\n### Proof of concept\n\nAgainst a NestJS microservice on the TCP transport (default port 3001). The nested JSON is built as text rather than\nwith `JSON.stringify`, which is what makes the payload serializable by the attacker but not by the victim:\n\n```js\nconst { connect } = require('node:net');\n\nconst DEPTH = 100_000;\nconst pattern = '{\"nested\":'.repeat(DEPTH) + '{}' + '}'.repeat(DEPTH);\nconst payload = `{\"pattern\":${pattern},\"data\":null,\"id\":\"1\"}`;\n\nconst socket = connect(3001, '127.0.0.1', () => {\n  // Nest's TCP framing is <byteLength>#<json>\n  socket.write(`${Buffer.byteLength(payload)}#${payload}`);\n});\n```\n\nThe service exits with `RangeError: Maximum call stack size exceeded`. The equivalent payload published to the\nconsumed queue crashes a RabbitMQ-transport service.\n\n### Patches\n\nFixed in **12.0.2** and **11.2.4**.\n\n- Incoming patterns are converted through a guarded `Server#getPatternAsString`, which falls back to a sentinel value\n  that matches no handler. Such a message now receives the ordinary \"no message handler\" response (TCP) or is\n  negatively acknowledged (RabbitMQ) instead of crashing the process.\n- Rejections escaping `handleMessage` in both transports are routed to `handleError` rather than left unhandled.\n\n### Workarounds\n\nIf you cannot upgrade, restrict network access to the transport so that only trusted peers can reach it. Running the\nprocess with `--unhandled-rejections=warn` prevents the crash but leaves the message unprocessed and is not a\nsubstitute for the fix.\n\n### Credit\n\nReported by ZeroVuln Labs.","state":0,"publishedAt":"2026-09-29T23:54:44+00:00","modifiedAt":"2026-09-30T00:00:03.84976+00:00","affected":[{"ecosystem":"npm","name":"@nestjs/microservices","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"11.2.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@nestjs/microservices","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"12.0.0"},{"kind":"fixed","version":"12.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg","https://nvd.nist.gov/vuln/detail/CVE-2026-102281","https://github.com/nestjs/nest/pull/17737","https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f","https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da","https://github.com/nestjs/nest","https://github.com/nestjs/nest/releases/tag/v11.2.4","https://github.com/nestjs/nest/releases/tag/v12.0.2"],"sourceUrl":"https://github.com/advisories/GHSA-m8vh-jmq9-5rjg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m8vh-jmq9-5rjg","identifiers":["GHSA-m8vh-jmq9-5rjg","CVE-2026-102281"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0427292+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0427301+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-c8f0a5eb97b437649f83f6fe632ec849fcb249052407d33e475e82c88b318dfb","complete":true,"records":424535,"lastAttemptAt":"2026-11-12T02:56:45.3610802+00:00","lastSuccessAt":"2026-11-12T02:56:45.341976+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.3610802+00:00","snapshotPublishedAt":"2026-11-12T02:25:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3bce114846604d92838a2dc302341627","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T03:06:53.8778262+00:00","lastSuccessAt":"2026-11-12T03:06:52.8+00:00","error":"754 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T03:06:52.8+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13040,"expectedIdentifiers":13813,"failedIdentifiers":754},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0434469+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0434471+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-729a419ccc5f41d8a3330c7c6e8b6a5e","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T02:57:11.7691852+00:00","lastSuccessAt":"2026-11-12T02:57:11.766+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:57:11.766+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T02:56:45.7363501+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.7363501+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T02:56:45.5271491+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.5271491+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T02:56:45.8443473+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.8443473+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T02:56:45.6384803+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.6384803+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}