A critical stack overflow vulnerability in the NestJS microservices framework allows remote, unauthenticated attackers to trigger a denial of service condition.

This flaw stems from uncontrolled recursion in the handleData function, where processing multiple small JSON messages within a single TCP frame leads to a stack overflow. The attack requires no authentication and can be triggered remotely by sending a payload of approximately 47 KB.

The vulnerability carries a CVSS score of 7.5, indicating a high risk to service availability. Successful exploitation results in a crash of the microservice instance, potentially leading to significant downtime for dependent applications and business processes. Because the vulnerability is automatable, it poses a direct threat to the stability of public-facing infrastructure.

Immediate Action: Update the @nestjs/microservices package to version 11.1.19 or later to incorporate the recursive logic fix.

Proactive Monitoring: Monitor application logs for repeated RangeError exceptions or abnormal termination patterns that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or similar inspection tool to filter or rate-limit malformed JSON payloads and large TCP frames before they reach the service.

Public Exploit Available: No (no confirmed public exploit)

Given the ease of exploitation and the potential for service disruption, organizations running NestJS microservices should prioritize this update. Verify that all instances are patched to version 11.1.19 immediately to ensure the stability and availability of your server-side applications.