{"id":"CVE-2026-40879","aliases":["CLSA-2026-1787795582","CLSA-2026-1792161434","CLSA-2026-1792161675","CLSA-2026-1792161752","CLSA-2026-1792161840","CLSA-2026-1792161909","CLSA-2026-1792161969","CLSA-2026-1792162004","EUVD-2026-24264","GHSA-hpwf-8g29-85qm"],"status":"published","title":"Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00329,"percentile":0.26392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-770"],"published":"2026-04-14T00:15:09Z","modified":"2026-11-02T19:59:00Z","fixes":[{"ecosystem":"npm","package":"@nestjs/microservices","fixed_in":["11.1.19"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@nestjs/websockets","fixed_in":["10.4.22-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nestjs/platform-fastify","fixed_in":["10.4.22-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nestjs/platform-ws","fixed_in":["10.4.22-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nestjs/testing","fixed_in":["10.4.22-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@nestjs/microservices","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"11.1.18"},{"fixed":"11.1.19"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/websockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/microservices","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/platform-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/platform-fastify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/platform-socket.io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/platform-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nestjs/testing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.4.22-tuxcare.0"},{"fixed":"10.4.22-tuxcare.1"}]}],"versions":["10.4.22"]},{"source":"osv","ecosystem":"npm","package":"@nestjs/microservices","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.1.19"}]}]}],"products":[{"vendor":"nestjs","product":"nest"}],"references":[{"url":"https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40879","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hpwf-8g29-85qm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40879.json","tags":["advisory"]},{"url":"https://github.com/nestjs/nest","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40879","title":"Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","status":"published","published":"2026-04-21T19:14:17.894Z","modified":"2026-04-21T19:38:04.805Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-24264","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","status":"published","published":"2026-04-21T19:14:17Z","modified":"2026-04-21T19:38:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:21.512647Z"}],"ghsa":[{"id":"GHSA-hpwf-8g29-85qm","title":"Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)","description":"### Impact\nAttacker sends many small, valid JSON messages in one TCP frame\n → handleData() recurses once per message; buffer shrinks each call\n → maxBufferSize is never reached; call stack overflows instead\n → A ~47 KB payload is sufficient to trigger RangeError\n\n### Patches\n\nFixed in `@nestjs/microservices@11.1.19`\n\n### References\n\nDiscovered by https://github.com/hwpark6804-gif","status":"published","published":"2026-04-14T00:15:09Z","modified":"2026-04-27T16:16:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T14:39:58.897998Z"}],"nvd":[{"id":"CVE-2026-40879","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","status":"published","published":"2026-04-21T20:17:01.533Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-40879","title":"Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)","description":"Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.","status":"published","published":"2026-04-21T19:14:17.894Z","modified":"2026-10-28T02:30:47.29383942Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-hpwf-8g29-85qm","title":"Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)","description":"### Impact\nAttacker sends many small, valid JSON messages in one TCP frame\n → handleData() recurses once per message; buffer shrinks each call\n → maxBufferSize is never reached; call stack overflows instead\n → A ~47 KB payload is sufficient to trigger RangeError\n\n### Patches\n\nFixed in `@nestjs/microservices@11.1.19`\n\n### References\n\nDiscovered by https://github.com/hwpark6804-gif","status":"published","published":"2026-04-14T00:15:09Z","modified":"2026-05-05T16:07:32.834605Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"CLSA-2026-1787795582","title":"TuxCare security update for @nestjs/websockets (1 CVE)","description":"TuxCare rebuilt @nestjs/websockets to address 1 CVE. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-08-27T01:53:01Z","modified":"2026-11-02T19:58:26.462593063Z","updated_at":"2026-11-02T20:24:01.862566Z"},{"id":"CLSA-2026-1792161434","title":"TuxCare security update for @nestjs/common (2 CVEs)","description":"TuxCare rebuilt @nestjs/common to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:37:14Z","modified":"2026-10-16T16:30:51.941983429Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161675","title":"TuxCare security update for @nestjs/microservices (2 CVEs)","description":"TuxCare rebuilt @nestjs/microservices to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:41:15Z","modified":"2026-10-16T16:31:07.072420709Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161752","title":"TuxCare security update for @nestjs/platform-express (2 CVEs)","description":"TuxCare rebuilt @nestjs/platform-express to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:42:32Z","modified":"2026-10-16T16:31:29.12365872Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161840","title":"TuxCare security update for @nestjs/platform-fastify (1 CVE)","description":"TuxCare rebuilt @nestjs/platform-fastify to address 1 CVE. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:44:00Z","modified":"2026-11-02T19:58:35.310280783Z","updated_at":"2026-11-02T20:23:24.187114Z"},{"id":"CLSA-2026-1792161909","title":"TuxCare security update for @nestjs/platform-socket.io (2 CVEs)","description":"TuxCare rebuilt @nestjs/platform-socket.io to address 2 CVEs. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:45:09Z","modified":"2026-10-16T16:31:41.015861481Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161969","title":"TuxCare security update for @nestjs/platform-ws (1 CVE)","description":"TuxCare rebuilt @nestjs/platform-ws to address 1 CVE. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:46:09Z","modified":"2026-11-02T19:58:52.81648557Z","updated_at":"2026-11-02T20:22:02.736609Z"},{"id":"CLSA-2026-1792162004","title":"TuxCare security update for @nestjs/testing (1 CVE)","description":"TuxCare rebuilt @nestjs/testing to address 1 CVE. Fixed in 10.4.22-tuxcare.1.","status":"published","published":"2026-10-16T14:46:44Z","modified":"2026-11-02T19:59:00.80675655Z","updated_at":"2026-11-02T20:21:30.928169Z"}]}}