Nest: Remote process termination via a deeply nested microservice message pattern

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-102281 · Microsoft / collected KEV context

EUVD-2026-88511

GHSA-m8vh-jmq9-5rjg

cve-program · CVE-2026-102281

• https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
• https://github.com/nestjs/nest/pull/17737
• https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
• https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
• https://github.com/nestjs/nest/releases/tag/v11.2.4
• https://github.com/nestjs/nest/releases/tag/v12.0.2

euvd · EUVD-2026-88511

• https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
• https://github.com/nestjs/nest/pull/17737
• https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
• https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
• https://github.com/nestjs/nest/releases/tag/v11.2.4
• https://github.com/nestjs/nest/releases/tag/v12.0.2

nvd · CVE-2026-102281

• https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
• https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
• https://github.com/nestjs/nest/pull/17737
• https://github.com/nestjs/nest/releases/tag/v11.2.4
• https://github.com/nestjs/nest/releases/tag/v12.0.2
• https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg

osv · GHSA-m8vh-jmq9-5rjg

• https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
• https://nvd.nist.gov/vuln/detail/CVE-2026-102281
• https://github.com/nestjs/nest/pull/17737
• https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
• https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
• https://github.com/nestjs/nest
• https://github.com/nestjs/nest/releases/tag/v11.2.4
• https://github.com/nestjs/nest/releases/tag/v12.0.2

No related operational record is retained in the current change model.