CVE-2026-102281

{
  "etk_id": "ETK-2026-64",
  "cve_id": "CVE-2026-102281",
  "display_id": "CVE-2026-102281",
  "ghsa_id": "GHSA-m8vh-jmq9-5rjg",
  "euvd_id": "EUVD-2026-88511",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Denial of service in @nestjs/microservices message handling",
  "summary": "Affected @nestjs/microservices releases can terminate a TCP- or RabbitMQ-based microservice while processing an excessively nested message pattern. An attacker must be able to reach the TCP listener or publish to the RabbitMQ queue or exchange consumed by the service; other transports are not affected.",
  "mitigation": "Upgrade @nestjs/microservices to 11.2.4 or 12.0.2, or a later compatible release. Until upgraded, limit TCP access and RabbitMQ publishing privileges to trusted peers.",
  "vendor": "npm",
  "product": "npm:@nestjs/microservices",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 11.2.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "11.2.4"
      ],
      "package_name": "@nestjs/microservices",
      "purl": "pkg:npm/@nestjs/microservices"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.0.0, < 12.0.2"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "12.0.2"
      ],
      "package_name": "@nestjs/microservices",
      "purl": "pkg:npm/@nestjs/microservices"
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0038,
  "epss_percentile": 0.3014,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.61545448333333,
  "t0_at": "2026-09-28T21:21:25.047000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-29T23:54:44+00:00",
      "days": 1.106469363425926,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T21:21:25.047000+00:00",
      "url": "https://github.com/advisories/GHSA-m8vh-jmq9-5rjg"
    },
    "trigger_signal": {
      "at": "2026-09-28T21:21:25.047000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T21:21:25.047000+00:00",
      "url": "https://github.com/advisories/GHSA-m8vh-jmq9-5rjg"
    }
  }
}