CVE-2026-102281: Nest: Remote process termination via a deeply nested microservice message pattern
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NestJSto a version that resolves this vulnerability.Fixed in 11.2.4 - Upgrade
Upgrade
NestJSto a version that resolves this vulnerability.Fixed in 12.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
NestJS microservices using the TCP or RabbitMQ transport are affected before versions 11.2.4 and 12.0.2. Other transports are not affected because they receive message patterns as strings.
What access does an attacker need to crash the service?
An attacker must be able to reach the microservice TCP port or publish a message to the RabbitMQ queue or exchange consumed by the service. No authentication or user interaction is required according to the supplied vector.
Does this affect default Node.js behavior?
Yes. The crash occurs when deeply nested client-controlled patterns cause JSON.stringify to throw a maximum-call-stack RangeError, and the resulting unhandled promise rejection terminates Node.js under its default behavior.
How can I determine whether a service is vulnerable?
Check whether the service uses NestJS microservices with TCP or RabbitMQ transport and runs a version earlier than 11.2.4 or 12.0.2. Affected services can be terminated by a single message whose pattern is a sufficiently deeply nested object.