Nest: Remote process termination via a deeply nested microservice message pattern

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...

Uncaught Exception

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Uncaught Exception via unguarded JSON.stringify calls on client-controlled message patterns in the TCP and RMQ server handlers...

CVE-2026-102281

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

CVE-2026-102281

The NestJS framework (prior to versions 11.2.4 and 12.0.2 ) is vulnerable to a remote process termination when using the TCP or RabbitMQ transports. The root cause is that the ServerTCP#handleMessage and ServerRMQ#handleMessage functions pass a client-controlled non-string pattern to JSON.stringi...

CVE-2026-102281 Nest: Remote process termination via a deeply nested microservice message pattern

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCPhandleMessage and ServerRMQhandleMessage pass a...

Allocation of Resources Without Limits or Throttling

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an oversized input...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an...

Atlassian Confluence 8.9.x < 9.2.22 / 9.5.x < 10.2.14 (CONFSERVER-104406)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104406 advisory. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas help...

Uncontrolled Recursion

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Uncontrolled Recursion via parseAddresses in src/mime-node/index.ts when a recipient field is supplied as a deeply nested array. The native array-to-string...

SUSE CVE-2026-97057

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length abov...

SUSE CVE-2026-97058

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

Linux Distros Unpatched Vulnerability : CVE-2026-97058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeErro...

CVE-2026-97058

A flaw was found in sprintf-js. A remote attacker, by controlling format strings, can inject precision values that exceed ECMAScript limits. This lack of validation leads to uncaught RangeError exceptions, allowing the attacker to abort calling operations with a minimal payload, resulting in a...

CVE-2026-97057

A flaw was found in redis-parser. This vulnerability allows a malicious or compromised Redis endpoint to trigger an uncaught RangeError by sending a crafted RESP REdis Serialization Protocol header with an excessively large declared length. The flaw occurs because redis-parser fails to validate t...

CVE-2026-97057

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length abov...

CVE-2026-97058

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

AZL-105254 CVE-2026-97058 affecting package python-tensorboard 2.16.2-6

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

AZL-105069 CVE-2026-97058 affecting package js-jquery 3.5.0-4

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...