Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no credentials, and no valid message are required. Applications are affected only if they start a microservice with Transport.TCP and the transport's port is reachable by an untrusted peer. Affected versions | Package | Affected | Patched | |---|---|---| | @nestjs/microservices | = 12.0.0, < 12.0.3 | 12.0.3 | | @nestjs/microservices | < 11.2.5 | 11.2.5 | The same code is present in the 10.x line and earlier. Those lines are end-of-life and will not receive a patch; upgrade to a supported major. Only @nestjs/microservices is affected. No other package needs updating for this issue. Details Two independent paths let one peer grow the heap without bound. Partial packets are buffered with nothing to reap…
Recommended action: Upgrade to 12.0.3 or 11.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, < 12.0.2 and < 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 (upgrade to 12.0.3 / 11.2.5) | Summary A single message whose pattern is a deeply nested object terminates a NestJS microservice that uses the TCP or RabbitMQ transport. The server serialized the client-supplied pattern with JSON.stringify to derive the handler lookup key; on deeply nested input this throws RangeError: Maximum call stack size exceeded. The exception escaped the asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the default --unhandled-rejections=throw. Impact Denial of service, one message per crash, repeatable. The attacker needs to be able to reach the transport: connect to the TCP transport's port, or publish to the queue or exchange the service consumes from. The TCP transport performs no authentication by default, so on a…
Recommended action: Upgrade to 12.0.2 or 11.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError Patches Fixed in @nestjs/microservices@11.1.19 References Discovered by https://github.com/hwpark6804-gif
Recommended action: Upgrade to 11.1.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.