NestJS Microservices Recursive Data Handling Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the NestJS framework, specifically in the microservices package, prior to version 11.1.19. The issue arises in the TCP transport layer, where the handleData() function recursively processes small, valid JSON messages sent within a single TCP frame. This recursion causes the call stack to overflow, as the maximum buffer size is not reached. A payload of approximately 47 KB is sufficient to trigger this RangeError, leading to a stack overflow.

Impact

Exploitation of this vulnerability causes a stack overflow, resulting in a denial-of-service condition.

Remediation

Users can upgrade to @nestjs/microservices version 11.1.19 to address this vulnerability.