High, CVSS 7.5npmAmendedPublished
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
CVE-2026-97705 · GHSA-h89v-g948-47vp
- Affected
- npm moleculer >= 0.15.0-beta1, < 0.15.2; < 0.14.36
- Fixed in
- 0.14.360.15.2· Vendor fix available
- Issue
- The TCP transporter's packet parser (`src/transporters/tcp/parser.js`) reads the packet length field with `Buffer.prototype.readInt32BE`, a signed read. A crafted packet whose length field has the sign bit set yields a negative `length`. The parser then advances past the parsed message with `packet = packet.slice(length)`, but `Buffer.prototype.slice` clamps an out-of-range negative start index to `0`, so the buffer is returned unchanged. The `while (packet.length > 0)` loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely. Impact Any Moleculer node using the TCP transporter can be rendered completely unresponsive by an unauthenticated remote peer sending a single ~10-byte crafted TCP packet, before any protocol handshake or authentication takes place. `TcpReader.onTcpClientConnected` pipes each accepted socket's bytes straight into a fresh `Parser` instance (`socket.pipe(parser)`) with no…
Recommended action: Upgrade to 0.15.2 or 0.14.36 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.