CVE-2026-102281High· 7.5▾ MidnightPoC availableNest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
Last analysed / modified upstream
0.4% → 0.6%
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@nestjs/microservices < 11.2.4@nestjs/microservices >= 12.0.0, < 12.0.2Patched in:
@nestjs/microservices 11.2.4@nestjs/microservices 12.0.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
GHSA-9c5c-9qcx-q35qHigh· 7.4@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
CVE-2026-102265Medium· 5.3PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-113872High· 7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-110816Medium· 5.3### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toStri…
CVE-2026-107392Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2025-69211High· 7.4Nest is a framework for building scalable Node.js server-side applications