Skip to content
Heist/ feed
UnratedFix available

Nest: Unbounded memory growth in the NestJS TCP microservice transport

Type: advisorySource: OSV1 source record

## Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no credentials, and no valid message are required. Applications are affected only if they start a microservice with `Transport.TCP` and the transport's port is reachable by an untrusted peer. ## Affected versions | Package | Affected | Patched | |---|---|---| | `@nestjs/microservices` | `>= 12.0.0, < 12.0.3` | **12.0.3** | | `@nestjs/microservices` | `< 11.2.5` | **11.2.5** | The same code is present in the 10.x line and earlier. Those lines are end-of-life and will not receive a patch; upgrade to a supported major. Only `@nestjs/microservices` is affected. No other package needs updating for this issue. ## Details Two independent paths let one peer grow the heap without bound. ### Partial packets are buffered with nothing to reap them The TCP transport frames messages as `#`. A peer may declare a length, send part of the payload, and then stop. `JsonSocket` keeps the partial payload buffered while it waits for the rest, and nothing ever reclaimed it: there was no socket timeout, no cap on the number of connections, and no tracking of accepted sockets. `maxBufferSize` did not close this. It caps a single connection, defaulting to 128M characters, and is enforced per connection, so the effec

Announced Source revision 1
Original source ↗

GHSA-96h4-vgxj-gvm2

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-96h4-vgxj-gvm2

@nestjs/microservices

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
11.2.5

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

@nestjs/microservices

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
12.0.3

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.2.5"
          }
        ]
      }
    ],
    "package": {
      "name": "@nestjs/microservices",
      "purl": "pkg:npm/%40nestjs/microservices",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-96h4-vgxj-gvm2/GHSA-96h4-vgxj-gvm2.json"
    }
  },
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "12.0.0"
          },
          {
            "fixed": "12.0.3"
          }
        ]
      }
    ],
    "package": {
      "name": "@nestjs/microservices",
      "purl": "pkg:npm/%40nestjs/microservices",
      "ecosystem": "npm"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-96h4-vgxj-gvm2/GHSA-96h4-vgxj-gvm2.json"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#37689 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement