@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0) potentially affected by unknown CVE via @nestjs/microservices (12.0.1)

@nestjs/microservices NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/microservices and may be impacted: - @hodfords/nestjs-base-decorator =12.0.0, =12.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +26 more potentially affected by unknown CVE via @nestjs/microservices (>=11.0.1, <=11.2.4)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: unknown CVE Source advisory: GHSA-96H4-VGXJ-GVM2...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +26 more potentially affected by unknown CVE via @nestjs/microservices (>=11.0.1, <=11.2.4)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-NESTJSMICROSERVICES-20419401...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0) potentially affected by unknown CVE via @nestjs/microservices (12.0.1)

@nestjs/microservices NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/microservices and may be impacted: - @hodfords/nestjs-base-decorator =12.0.0, =12.1.0 Source cves: unknown CVE Source advisory:...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0) potentially affected by unknown CVE via @nestjs/microservices (12.0.1)

@nestjs/microservices NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/microservices and may be impacted: - @hodfords/nestjs-base-decorator =12.0.0, =12.1.0 Source cves: unknown CVE Source advisory: GHSA-96H4-VGXJ-GVM2...

GHSA-96H4-VGXJ-GVM2 Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +26 more potentially affected by unknown CVE via @nestjs/microservices (>=11.0.1, <=11.2.4)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...

Allocation of Resources Without Limits or Throttling

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded memory growth in the TCP transport layer of JsonSocket. On the receiving...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (12.0.1)

@nestjs/microservices NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/microservices and may be impacted: - @hodfords/nestjs-base-decorator =12.0.0, =12.1.0 Source cves: CVE-2026-102281 Source advisory: GHSA-M8VH-JMQ9-5RJG...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (12.0.1)

@nestjs/microservices NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/microservices and may be impacted: - @hodfords/nestjs-base-decorator =12.0.0, =12.1.0 Source cves: CVE-2026-102281 Source advisory: OSV:GHSA-M8VH-JMQ9-5RJG...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +26 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: OSV:GHSA-M8VH-JMQ9-5RJG...

GHSA-M8VH-JMQ9-5RJG Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +26 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: GHSA-M8VH-JMQ9-5RJG...

Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

Uncaught Exception

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Uncaught Exception via unguarded JSON.stringify calls on client-controlled message patterns in the TCP and RMQ server handlers...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +26 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: SNYK:JS-NESTJSMICROSERVICES-20251033...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: CVE-2026-102281 Source advisory: SNYK:JS-NESTJSMICROSERVICES-20251033...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (12.0.1)

@nestjs/microservices NPM version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/microservices and may be impacted: - @hodfords/nestjs-base-decorator =12.0.0, =12.1.0 Source cves: CVE-2026-102281 Source advisory: MEND:CVE-2026-102281...

@10abdullahbutt/nestjs-boilerplate (0.0.1), @aandreevv/microservice-connection-lib (>=1.0.6, <=1.0.8) +968 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=3.0.1, <=11.2.3)

@nestjs/microservices NPM version =3.0.1, =1.0.6, =0.0.8, =1.0.2, =0.0.1, =1.0.75, =1.0.0, =0.1.0, =0.1.0, =1.0.6, =1.7.8, =1.0.24, =1.0.2158-next.5 and more Source cves: CVE-2026-102281 Source advisory: MEND:CVE-2026-102281...