CVE-2026-40879
Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.
- Record
CVE-2026-40879- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-24264
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.
- Record
EUVD-2026-24264- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hpwf-8g29-85qm
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
Impact
Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError
Patches
Fixed in @nestjs/[email protected]
References
Discovered by https://github.com/hwpark6804-gif
- Record
GHSA-hpwf-8g29-85qm- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674, CWE-770
- Updated
- 2026-11-02
NVD
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.
- Record
CVE-2026-40879- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.
- Record
CVE-2026-40879- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVGHSA-hpwf-8g29-85qm
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)
Impact
Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError
Patches
Fixed in @nestjs/[email protected]
References
Discovered by https://github.com/hwpark6804-gif
- Record
GHSA-hpwf-8g29-85qm- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674, CWE-770
- Updated
- 2026-11-02
Show 9 moreShow less
OSVCLSA-2026-1787795582 No score
TuxCare security update for @nestjs/websockets (1 CVE)
TuxCare rebuilt @nestjs/websockets to address 1 CVE. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1787795582- Updated
- 2026-11-02
OSVCLSA-2026-1792161434 No score
TuxCare security update for @nestjs/common (2 CVEs)
TuxCare rebuilt @nestjs/common to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161434- Updated
- 2026-11-02
OSVCLSA-2026-1792161496 No score
TuxCare security update for @nestjs/core (2 CVEs)
TuxCare rebuilt @nestjs/core to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161496- Updated
- 2026-11-02
OSVCLSA-2026-1792161675 No score
TuxCare security update for @nestjs/microservices (2 CVEs)
TuxCare rebuilt @nestjs/microservices to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161675- Updated
- 2026-11-02
OSVCLSA-2026-1792161752 No score
TuxCare security update for @nestjs/platform-express (2 CVEs)
TuxCare rebuilt @nestjs/platform-express to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161752- Updated
- 2026-11-02
OSVCLSA-2026-1792161840 No score
TuxCare security update for @nestjs/platform-fastify (1 CVE)
TuxCare rebuilt @nestjs/platform-fastify to address 1 CVE. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161840- Updated
- 2026-11-02
OSVCLSA-2026-1792161909 No score
TuxCare security update for @nestjs/platform-socket.io (2 CVEs)
TuxCare rebuilt @nestjs/platform-socket.io to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161909- Updated
- 2026-11-02
OSVCLSA-2026-1792161969 No score
TuxCare security update for @nestjs/platform-ws (1 CVE)
TuxCare rebuilt @nestjs/platform-ws to address 1 CVE. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792161969- Updated
- 2026-11-02
OSVCLSA-2026-1792162004 No score
TuxCare security update for @nestjs/testing (1 CVE)
TuxCare rebuilt @nestjs/testing to address 1 CVE. Fixed in 10.4.22-tuxcare.1.
- Record
CLSA-2026-1792162004- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@nestjs/microservicesnpm |
through 11.1.18 | 11.1.19 |
@nestjs/websocketsTuxCare:npm |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/commonTuxCare:npm From an advisory covering 2 CVEs |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/coreTuxCare:npm From an advisory covering 2 CVEs |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/microservicesTuxCare:npm From an advisory covering 2 CVEs |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/platform-expressTuxCare:npm From an advisory covering 2 CVEs |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/platform-fastifyTuxCare:npm |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/platform-socket.ioTuxCare:npm From an advisory covering 2 CVEs |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/platform-wsTuxCare:npm |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/testingTuxCare:npm |
10.4.22-tuxcare.0 up to 10.4.22-tuxcare.1, plus listed versions 10.4.22 |
10.4.22-tuxcare.1 |
@nestjs/microservicesnpm |
before 11.1.19 | 11.1.19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40879 is a high vulnerability (CVSS 7.5) in Nestjs Nest, published April 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in @nestjs/microservices 11.1.19.