CVE-2026-102281: @nestjs/microservices Remote Process Termination via Deeply Nested Message Pattern
Summary
CVE-2026-102281: Nest: Remote process termination via a deeply nested microservice message pattern. Affects @nestjs/microservices across 2 version ranges.
< 11.2.4
>= 12.0.0, < 12.0.2
Fixed in 11.2.4 or 12.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nestjs/microservices package is part of the NestJS framework, which is designed for building efficient, reliable, and scalable server-side applications. This package provides microservices capabilities, allowing developers to create distributed systems using various transport layers like TCP and RabbitMQ. However, it is vulnerable to a specific issue that can lead to remote process termination when handling deeply nested message patterns.
Vulnerability Detail
The vulnerability arises from the way the @nestjs/microservices package handles incoming messages. Specifically, when a message contains a deeply nested object as its pattern, the server attempts to serialize this object using JSON.stringify. If the nesting is too deep, it results in a RangeError: Maximum call stack size exceeded. This unhandled exception can cause the Node.js process to terminate, leading to a denial of service. The vulnerability affects only the TCP and RabbitMQ transports, as other transports do not serialize client-supplied objects in this manner.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 11.2.411.2.4npm install @nestjs/microservices@11.2.4 -
>= 12.0.0, < 12.0.212.0.2npm install @nestjs/microservices@12.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not possible, restrict network access to the transport so that only trusted peers can connect. Additionally, running the process with the flag --unhandled-rejections=warn can prevent crashes, but this will leave messages unprocessed. Here is an example of how to restrict access in a Node.js application:
const net = require('net');
const server = net.createServer((socket) => {
// Handle socket connection
});
server.listen(3001, '127.0.0.1');
// Restrict to localhost
Conclusion
The CVE-2026-102281 vulnerability in the @nestjs/microservices package poses a significant risk of denial of service due to unhandled exceptions from deeply nested message patterns. It is crucial to update to the patched versions or implement workarounds to mitigate the risk.
See every vulnerability recorded for @nestjs/microservices →
FAQ
CVE-2026-102281 is a vulnerability in the @nestjs/microservices package that allows remote process termination through deeply nested message patterns.
If your application uses the TCP or RabbitMQ transport in @nestjs/microservices, an attacker can send a specially crafted message that causes the Node.js process to crash.
The vulnerability has been patched in versions 12.0.2 and 11.2.4 of the @nestjs/microservices package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @nestjs/microservices.
