CVE-2026-102281: Nest: Remote process termination via a deeply nested microservice message pattern
A single message whose pattern is a deeply nested object terminates a NestJS microservice that uses the TCP or
RabbitMQ transport. The server serialized the client-supplied pattern with JSON.stringify to derive the handler
lookup key; on deeply nested input this throws RangeError: Maximum call stack size exceeded. The exception escaped
the asynchronous message handler as an unhandled promise rejection, which terminates the Node.js process under the
default --unhandled-rejections=throw.
References
- github.com/advisories/GHSA-m8vh-jmq9-5rjg
- github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
- github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
- github.com/nestjs/nest/pull/17737
- github.com/nestjs/nest/releases/tag/v11.2.4
- github.com/nestjs/nest/releases/tag/v12.0.2
- github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
- nvd.nist.gov/vuln/detail/CVE-2026-102281
Code Behaviors & Features
Detect and mitigate CVE-2026-102281 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →