Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The @nestjs/microservices npm package is vulnerable in versions below 11.2.4 and from 12.0.0 up to but not including 12.0.2, when using the TCP or RabbitMQ transports. An attacker who can reach the TCP port or publish to the queue or exchange the service consumes from can send one deeply nested message pattern that crashes the Node.js process, causing denial of service; the TCP transport has no authentication by default. Upgrade to 11.2.4 or 12.0.2 or later, or restrict network access to the transport as a workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0059, the 48th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:34 UTC First seen by agentprime
- 31 Oct 2026, 13:34 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-m8vh-jmq9-5rjg
- OSV: GHSA-m8vh-jmq9-5rjg
- github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
- nvd.nist.gov/vuln/detail/CVE-2026-102281
- github.com/nestjs/nest/pull/17737
- github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
- github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
- github.com/nestjs/nest
- github.com/nestjs/nest/releases/tag/v11.2.4
- github.com/nestjs/nest/releases/tag/v12.0.2