# CVE-2026-40879: @nestjs/microservices — Fixed in 11.1.19 📦 📦 npm Not in CISA KEV HIGH severity # CVE-2026-40879 — @nestjs/microservices HIGH CVE-2026-40879 is a high-severity (CVSS 7.5) CWE-674 vulnerability in @nestjs/microservices. A fix is available for @nestjs/microservices — see the affected versions and patch details below. Nest: DoS via Recursive handleData in JsonSocket (TCP Transport) Also known as[GHSA-hpwf-8g29-85qm](/vulnerability/GHSA-hpwf-8g29-85qm) Published Apr 21, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-40879. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs26th percentile — riskier than 26% of all scored CVEsHighest risk 0.00%0.32%0.64%0.96%0.1%0.3%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 2Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream `@nestjs/microservices`npm 3.0Mdownloads / week ## Description Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 📦npm `@nestjs/microservices` all versions 11.1.19`npm install @nestjs/microservices@11.1.19` ## Affected Products 1 product · 1 configurations Application `nest`nestjs < 11.1.19 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @nestjs/microservices, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update @nestjs/microservices to 11.1.19 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-40879 is resolved across your whole dependency graph. 3. ### Workarounds Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process. ## Frequently Asked Questions Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19. O3 Security · Impact-Aware SCA ### Is CVE-2026-40879 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)