CVE-2026-40879: Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)
### Impact Attacker sends many small, valid JSON messages in one TCP frame → handleData() recurses once per message; buffer shrinks each call → maxBufferSize is never reached; call stack overflows instead → A ~47 KB payload is sufficient to trigger RangeError ### Patches Fixed in `@nestjs/microservices@11.1.19` ### References Discovered by https://github.com/hwpark6804-gif
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40879?
CVE-2026-40879 has a severity that can lead to a denial of service (DoS) condition due to stack overflow issues.
How do I fix CVE-2026-40879?
To fix CVE-2026-40879, upgrade to version 11.1.19 or later of the @nestjs/microservices package.
What software is affected by CVE-2026-40879?
CVE-2026-40879 affects versions of @nestjs/microservices up to and including 11.1.18 and all versions of the Nest framework prior to 11.1.19.
What causes the vulnerability in CVE-2026-40879?
The vulnerability in CVE-2026-40879 is caused by handling many small valid JSON messages in one TCP frame, leading to recursive function calls.
What are the implications of CVE-2026-40879 for application security?
The implications of CVE-2026-40879 include potential service unavailability due to denial of service attacks targeting the application.