GHSA-96h4-vgxj-gvm2: Nest: Unbounded memory growth in the NestJS TCP microservice transport

A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no credentials, and no valid message are required.

Applications are affected only if they start a microservice with Transport.TCP and the transport’s port is reachable by an untrusted peer.