CVE-2026-102281: Nest: Remote process termination via a deeply nested microservice message pattern
A single message whose pattern is a deeply nested object terminates a NestJS microservice that uses the TCP or
RabbitMQ transport. The server serialized the client-supplied pattern with JSON.stringify to derive the handler
lookup key; on deeply nested input this throws RangeError: Maximum call stack size exceeded. The exception escaped
the asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the
default --unhandled-rejections=throw.
References
- github.com/advisories/GHSA-m8vh-jmq9-5rjg
- github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
- github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
- github.com/nestjs/nest/pull/17737
- github.com/nestjs/nest/releases/tag/v11.2.4
- github.com/nestjs/nest/releases/tag/v12.0.2
- github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
- nvd.nist.gov/vuln/detail/CVE-2026-102281
Code Behaviors & Features
Detect and mitigate CVE-2026-102281 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →