https://vulnerability.circl.lu/sightings/feed 2026-10-08T19:27:00.851530+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/140745a6-957b-4236-9826-aa24c46eeb27/export 2026-10-08T19:27:00.883743+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "140745a6-957b-4236-9826-aa24c46eeb27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102281", "type": "seen", "source": "https://gist.github.com/alon710/a6e12fc114cac57d3edf73935c792e97", "content": "# CVE-2026-102281: CVE-2026-102281: Denial of Service via Uncaught Exception in @nestjs/microservices\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102281\n\n## Summary\nAn unauthenticated remote attacker can crash NestJS microservices utilizing TCP or RabbitMQ transport layers. The vulnerability exists due to recursive serialization of deeply nested message patterns using JSON.stringify, leading to a RangeError and process termination.\n\n## TL;DR\nA single, deeply nested pattern object can crash a NestJS microservice utilizing TCP or RabbitMQ transport due to uncaught RangeError exceptions.\n\n## Technical Details\n\n- **CWE ID**: CWE-674, CWE-248\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00376 (29.01% percentile)\n- **Impact**: Availability (Denial of Service)\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- NestJS microservices using TCP or RabbitMQ transport layers\n- **NestJS Microservices**: < 11.2.4 (Fixed in: `11.2.4`)\n- **NestJS Microservices**: >= 12.0.0, < 12.0.2 (Fixed in: `12.0.2`)\n\n## Mitigation\n\n- Update dependency to secure version\n- Configure network firewall rules\n- Restrict queue publishing permissions\n- Apply runtime flags\n\n**Remediation Steps:**\n1. Identify the current version of @nestjs/microservices\n2. Run 'npm install @nestjs/microservices@11.2.4' or '@nestjs/microservices@12.0.2' depending on your major version\n3. Rebuild and deploy the microservice\n4. Verify that the dependency lockfile registers the patched version\n\n## References\n\n- [GitHub Security Advisory](https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg)\n- [Pull Request Fix](https://github.com/nestjs/nest/pull/17737)\n- [Fix Commit (Main Branch)](https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f)\n- [Fix Commit (v11 Branch)](https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-102281)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102281) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T00:30:31.000000Z"} 2026-09-30T00:30:31+00:00 https://vulnerability.circl.lu/sighting/5eabf7df-eca6-468c-a853-2be53339e9e8/export 2026-10-08T19:27:00.885997+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "5eabf7df-eca6-468c-a853-2be53339e9e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-102281", "type": "published-proof-of-concept", "source": "https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg", "content": "", "creation_timestamp": "2026-09-15T08:38:29.000000Z"} 2026-09-15T08:38:29+00:00