CVE-2026-97705 in Moleculer
Summary
by MITRE • 11/04/2026
Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
Moleculer serves as a progressive microservices framework for Node.js applications, facilitating communication between distributed services through various transport mechanisms including TCP. A critical vulnerability exists within the TCP transporter implementation in versions prior to 0.14.36 and 0.15.2, specifically located in the Parser._write method found in src/transporters/tcp/parser.js. This component is responsible for parsing incoming network packets by interpreting binary data into structured messages that can be processed by the application logic. The security flaw arises from how this parser handles packet length fields during deserialization operations.
The technical root cause of this vulnerability lies in the use of Buffer.prototype.readInt32BE to read the signed integer representing the packet length. Because int32 is a signed data type, it can represent negative values ranging from -2147483648 to 2147483647. When an unauthenticated remote peer supplies a maliciously crafted TCP packet containing a negative value in the length field, the parser interprets this as a valid but erroneous integer. Consequently, when the code attempts to slice the buffer using this negative index via packet.slice(length), JavaScript returns the unchanged original buffer rather than throwing an error or returning an empty array. This behavior creates a logical flaw where the expected payload extraction fails silently while preserving the full input data.
This logic error triggers an infinite synchronous loop within the parsing routine, governed by the condition while (packet.length > 0). Since slicing with a negative index does not reduce the buffer size in this context, packet.length remains constant and greater than zero throughout execution. The Node.js runtime operates on a single-threaded event loop model where long-running synchronous operations block all other concurrent tasks. As a result, the infinite loop monopolizes the CPU thread indefinitely, preventing the processing of any subsequent network requests or internal service messages. This effectively causes a complete denial of service for every microservice running within that Node.js process instance until the application is manually restarted to clear the hung state.
The operational impact of this vulnerability is severe as it allows remote unauthenticated attackers to disrupt availability with minimal effort. The attack does not require authentication credentials, making it accessible to any entity capable of establishing a TCP connection to the exposed service endpoint. Furthermore, existing defensive measures such as CRC validation and maxPacketSize configurations are ineffective against this specific exploit because they do not validate the sign or logical consistency of the parsed length field before processing begins. The vulnerability persists across both major version lines affected, indicating that similar code patterns were present in legacy maintenance releases up to 0.14.x and current development branches leading into 0.15.x prior to the patch release.
From a classification perspective, this issue aligns with CWE-674 Uncontrolled Recursion or Infinite Loop, as well as CWE-20 Improper Input Validation regarding the failure to verify that input data meets expected constraints before processing. In terms of attack tactics, it corresponds to MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically involving resource exhaustion through CPU saturation via a sustained computational loop rather than memory consumption alone. The lack of proper bounds checking on signed integers used for buffer manipulation is also indicative of CWE-682 Incorrect Calculation, where the arithmetic operation yields an unexpected result that breaks subsequent logic assumptions.
Mitigation strategies primarily involve upgrading to patched versions 0.14.36 and 0.15.2 or later, which implement proper validation checks on packet length fields before slicing operations occur. Developers should ensure that any custom parsers adhere strictly to unsigned integer types for size indicators when dealing with binary protocols to prevent negative value interpretation. Additionally, implementing network-level rate limiting and connection timeouts can provide a secondary layer of defense by restricting the volume or duration of connections from untrusted sources. For environments where immediate patching is not feasible, deploying reverse proxies that inspect TCP payloads for malformed length headers before forwarding traffic to backend services offers an effective compensating control against exploitation attempts.