Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40879Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)

High 7.5

In plain English

A high-severity security flaw in nest from nestjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nestjs/microservices	11.1.19	GHSA-hpwf-8g29-85qm

Affected products (as reported)

Vendor	Product	Versions
nestjs	nest	< 11.1.19

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm x_refsource_CONFIRM