CVE-2026-102281— Nest: Remote process termination via a deeply nested microservice message pattern
Quick assessment
Affected
nestjs nest
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nest 是一个用于构建可扩展 Node.js 服务端应用程序的框架。在 11.2.4 和 12.0.2 版本之前，如果通过 TCP 或 RabbitMQ 传输协议发送一条在模式（pattern）中包含深层嵌套对象的单个消息，即可导致 NestJS 微服务崩溃。具体而言， 和 方法会将客户端控制的、非字符串类型的 pattern 传入 以生成处理器查找键；当嵌套层次足够深时，会引发 （范围错误：最大调用栈大小超出）异常，而该未处理的 Promise 拒绝将导致 Node.js 在其默认行为下终止进程。 攻击者若能访
Possible ATT&CK Techniques 1 AI
T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nest: Remote process termination via a deeply nested microservice message pattern
Source: CVE Program / CVE List V5
Vulnerability Description
Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently deep nesting throws RangeError: Maximum call stack size exceeded, and the unhandled promise rejection terminates Node.js under its default behavior. An attacker who can reach the TCP port or publish to the consumed RabbitMQ queue or exchange can crash the service on demand; other transports are not affected because their patterns arrive as strings. This issue is fixed in versions 11.2.4 and 12.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-102281
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102281
请登录查看更多情报信息。
Other References for CVE-2026-102281 (6)
-
https://github.com/nestjs/nest/pull/17737 x_refsource_MISC
-
https://github.com/nestjs/nest/releases/tag/v12.0.2 x_refsource_MISC
-
https://github.com/nestjs/nest/releases/tag/v11.2.4 x_refsource_MISC
-
https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: nest
-
CVE-2025-36939
Google Nest 缓冲区错误漏洞 -
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash -
CVE-2026-40879
Nest: DoS via Recursive handleData in JsonSocket (TCP Transp -
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Outp -
CVE-2026-33011
Nest Fastify HEAD Request Middleware Bypass
Same vendor: nestjs
-
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash -
CVE-2026-40879
Nest: DoS via Recursive handleData in JsonSocket (TCP Transp -
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Outp -
CVE-2026-33011
Nest Fastify HEAD Request Middleware Bypass -
CVE-2025-69211
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
Same weakness: CWE-248
-
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verificatio -
CVE-2026-101101
ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaug -
CVE-2026-101035
aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage unc -
CVE-2026-100722
vm2 before 3.12.2 Host Process Termination via Construct Tra -
CVE-2026-100675
stoatchat before 0.15.5 Denial of Service via mass mentions
V. Comments for CVE-2026-102281
No comments yet