AIKIDO-2026-828288
@nestjs/microservices is vulnerable to Denial of Service (DoS)
50
Medium Risk
This Affects:
@nestjs/microservicesTL;DR
The TCP microservice transport lets an unauthenticated peer send a partial JSON frame and then stop talking, keeping the incomplete payload buffered in memory with no time limit. The same transport queues outgoing responses without honoring socket.write backpressure, so a peer that sends requests without reading the replies can grow the send buffer without bound, and sockets accepted before close() stay open and keep dispatching message handlers after shutdown. Any of these paths lets a remote peer exhaust server memory or keep a stale connection alive using ordinary TCP traffic. The fix adds an incomplete-message timeout, enforces a maximum send-buffer size with backpressure, and destroys tracked sockets when the server closes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the TCP microservice transport and the TCP microservice transport port is reachable by untrusted peers.
Background info
@nestjs/microservices is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 11.2.4 and 12.0.0 - 12.0.2.
How to fix this
Upgrade the @nestjs/microservices library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.