CVE-2026-102281 in Nest
Summary
by MITRE • 09/29/2026
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The NestJS framework, a popular progressive Node.js server-side application layer, contains a critical vulnerability affecting its microservice transport mechanisms prior to version 11.2.4 for the LTS branch and version 12.0.2 for the current release line. This flaw specifically impacts applications utilizing TCP or RabbitMQ transports, allowing an attacker with network access to these communication channels to trigger a denial of service condition. The vulnerability stems from how the framework processes incoming messages within its microservice architecture, where pattern matching is used to route requests to appropriate handlers. In the affected versions, the internal methods ServerTCP#handleMessage and ServerRMQ#handleMessage accept client-controlled input for the message pattern without sufficient validation or type checking before processing it further into the application logic.
The technical root cause lies in the improper handling of non-string patterns passed directly to JSON.stringify during the derivation of handler lookup keys. When a malicious actor sends a single message containing a deeply nested object structure, the JavaScript engine attempts to serialize this complex data structure. Due to the recursive nature of deep nesting, the serialization process exceeds the maximum call stack size allowed by Node.js, resulting in a RangeError: Maximum call stack size exceeded exception. Because NestJS versions prior to the fix do not adequately catch or handle this specific unhandled promise rejection within the message handling flow, the error propagates up and causes the Node.js event loop to terminate abruptly. This results in an immediate crash of the microservice instance, effectively rendering it unavailable until manual restart is performed by system administrators.
The operational impact of this vulnerability is a complete denial of service for any NestJS application relying on TCP or RabbitMQ transports. An attacker who can reach the exposed TCP port or publish messages to the consumed RabbitMQ queue or exchange does not need authentication or complex exploitation techniques beyond crafting a payload with sufficient nesting depth. This makes the attack vector highly accessible and reliable, as it relies on fundamental language limitations rather than obscure logic errors. It is important to note that other transport mechanisms such as HTTP, gRPC, or Redis are not affected by this specific issue because their implementations ensure that patterns arrive as strings before being processed for handler lookup, thereby avoiding the recursive serialization trap inherent in the TCP and RabbitMQ handlers.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically regarding the failure to validate the structure and depth of incoming data objects prior to processing. Furthermore, from a tactical perspective, this flaw facilitates Denial of Service attacks categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service or T1498 Network Denial of Service depending on whether the impact is localized to the host process or affects broader service availability. The exploitation does not require code execution privileges but rather network-level access, making it a significant risk for services exposed directly to untrusted networks without proper ingress filtering or rate limiting.
To mitigate this vulnerability, organizations must upgrade their NestJS dependencies immediately to version 11.2.4 or later if using the LTS branch, or version 12.0.2 and later for current releases. These updated versions include fixes that properly validate input types and handle potential stack overflow scenarios during pattern processing. For environments where immediate patching is not feasible due to dependency constraints, implementing network-level controls such as firewalls or API gateways can help restrict access to the affected TCP ports or RabbitMQ queues from untrusted sources. Additionally, configuring Node.js with higher heap limits may provide temporary resilience against stack overflow errors, though this does not address the root cause and should only be considered a short-term workaround while planning for an upgrade. Regular security audits of microservice architectures are recommended to ensure that input validation is consistently applied across all transport layers.