CVE-2026-97705: Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser.write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
moleculerto a version that resolves this vulnerability.Fixed in 0.14.36 - Upgrade
Upgrade
moleculerto a version that resolves this vulnerability.Fixed in 0.15.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments are exposed when the Moleculer TCP transporter is enabled and reachable by a remote peer. The issue can make every service running in the affected Node.js process unresponsive until the process is restarted.
Does an attacker need credentials or interaction from a user?
No. A remote unauthenticated peer can trigger the condition by supplying a malformed negative packet length.
Do CRC validation or maxPacketSize limit mitigate the malformed packet?
No. Neither CRC validation nor maxPacketSize prevents exploitation through the negative packet-length value.
Which versions contain the fix?
The issue is fixed in Moleculer versions 0.14.36 and 0.15.2. Versions prior to those releases are affected.