Go to packages list

nestjs-microservices

Ecosystem: npm

Downloads: 9.78 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 3 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 2 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High2 (66.7%)
  • Medium0 (0.0%)
  • Moderate1 (33.3%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting nestjs-microservices, based on data from OSV.

Vulnerabilities affecting nestjs-microservices
IDSeveritySummaryAffected versionsPublishedSource
GHSA-96h4-vgxj-gvm2ModerateNest: Unbounded memory growth in the NestJS TCP microservice transport## Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no credentials, and no valid message are required. Applications are affected only if they start a microservice with `Transport.TCP` and the transport's port is reachable by an untrusted peer. ## Affected versions | Package | Affected | Patched | |---|---|---| | `@nestjs/microservices` | `>= 12.0.0, < 12
  • < 11.2.5
  • >= 12.0.0, < 12.0.3
GitHub (opens in a new tab)
GHSA-m8vh-jmq9-5rjgHighNest: Remote process termination via a deeply nested microservice message pattern| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/microservices` | | Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` | | Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) | ### Summary A single message whose `pattern` is a deeply nested object terminates a NestJS microservice that uses the TCP or RabbitMQ transport. The server serialized the client-supplied pattern with `JSON.stringify` to derive the handler lookup key; on deeply nested input this throws `RangeError: Maximum call stack size exceeded`. The exception escaped the asynchron
  • < 11.2.4
  • >= 12.0.0, < 12.0.2
GitHub (opens in a new tab)
GHSA-hpwf-8g29-85qmHighNest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)### Impact Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError ### Patches Fixed in `@nestjs/microservices@11.1.19` ### References Discovered by https://github.com/hwpark6804-gif
  • < 11.1.19
GitHub (opens in a new tab)
  • GHSA-96h4-vgxj-gvm2Moderate
    Nest: Unbounded memory growth in the NestJS TCP microservice transport
    • < 11.2.5
    • >= 12.0.0, < 12.0.3
    GitHub (opens in a new tab)

    ## Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no credentials, and no valid message are required. Applications are affected only if they start a microservice with `Transport.TCP` and the transport's port is reachable by an untrusted peer. ## Affected versions | Package | Affected | Patched | |---|---|---| | `@nestjs/microservices` | `>= 12.0.0, < 12

  • GHSA-m8vh-jmq9-5rjgHigh
    Nest: Remote process termination via a deeply nested microservice message pattern
    • < 11.2.4
    • >= 12.0.0, < 12.0.2
    GitHub (opens in a new tab)

    | Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/microservices` | | Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` | | Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) | ### Summary A single message whose `pattern` is a deeply nested object terminates a NestJS microservice that uses the TCP or RabbitMQ transport. The server serialized the client-supplied pattern with `JSON.stringify` to derive the handler lookup key; on deeply nested input this throws `RangeError: Maximum call stack size exceeded`. The exception escaped the asynchron

    CVE: CVE-2026-102281

  • GHSA-hpwf-8g29-85qmHigh
    Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
    • < 11.1.19
    GitHub (opens in a new tab)

    ### Impact Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError ### Patches Fixed in `@nestjs/microservices@11.1.19` ### References Discovered by https://github.com/hwpark6804-gif

    CVE: CVE-2026-40879

Showing 1-3 of 3 vulnerabilities