@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by unknown CVE via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +25 more potentially affected by unknown CVE via @nestjs/microservices (>=11.0.1, <=11.2.4)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-96H4-VGXJ-GVM2...

Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

GHSA-96H4-VGXJ-GVM2 Nest: Unbounded memory growth in the NestJS TCP microservice transport

Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no...

Allocation of Resources Without Limits or Throttling

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded memory growth in the TCP transport layer of JsonSocket. On the receiving...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: CVE-2026-102281 Source advisory: OSV:GHSA-M8VH-JMQ9-5RJG...

Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

GHSA-M8VH-JMQ9-5RJG Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +25 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: OSV:GHSA-M8VH-JMQ9-5RJG...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +25 more potentially affected by CVE-2026-102281 via @nestjs/microservices (>=11.0.1, <=11.2.3)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.1.3 and more Source cves: CVE-2026-102281 Source advisory: SNYK:JS-NESTJSMICROSERVICES-20251033...

@hodfords/nestjs-base-decorator (>=12.0.0, <=12.1.0), @zerly/microservice (>=0.7.0, <=0.8.0) potentially affected by CVE-2026-102281 via @nestjs/microservices (>=12.0.0-alpha.2, <=12.0.1)

@nestjs/microservices NPM version =12.0.0-alpha.2, =12.0.0, =0.7.0, =0.8.0 Source cves: CVE-2026-102281 Source advisory: SNYK:JS-NESTJSMICROSERVICES-20251033...

Uncaught Exception

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Uncaught Exception via unguarded JSON.stringify calls on client-controlled message patterns in the TCP and RMQ server handlers...

Uncontrolled Recursion

@nestjs/microservices is vulnerable to Uncontrolled Recursion. The vulnerability is due to recursive processing of multiple JSON messages in a single TCP frame without proper recursion limits, which allows an attacker to trigger a stack overflow and crash the application...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +22 more potentially affected by CVE-2026-40879 via @nestjs/microservices (>=11.0.1, <=11.1.18)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.0.0, =1.1.11 and more Source cves: CVE-2026-40879 Source advisory: SNYK:JS-NESTJSMICROSERVICES-16082546...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.2) +22 more potentially affected by CVE-2026-40879 via @nestjs/microservices (>=11.0.1, <=11.1.18)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.0.0, =1.1.11 and more Source cves: CVE-2026-40879 Source advisory: OSV:GHSA-HPWF-8G29-85QM...

Uncontrolled Recursion

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Uncontrolled Recursion through the handleData function in packages/microservices/helpers/json-socket.ts. An attacker can crash the TCP...