GHSA-m8vh-jmq9-5rjg Nest: Remote process termination via a deeply nested microservice message pattern

• npm @nestjs/microservices: < 11.2.4 → fixed in 11.2.4 • npm @nestjs/microservices: >= 12.0.0, < 12.0.2 → fixed in 12.0.2

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/microservices` | | Affected versions | `>= 12.0.0, { // Nest's TCP framing is # socket.write(`${Buffer.byteLength(payload)}#${payload}`); }); ``` The service exits with `RangeError: Maximum call stack size exceeded`. The equivalent payload published to the consumed queue crashes a RabbitMQ-transport service. Patches Fixed in 12.0.2 and 11.2.4. • Incoming patterns are converted through a guarded `Server#getPatternAsString`, which falls back to a sentinel value that matches no handler. Such a message now receives the ordinary "no message handler" response (TCP) or is negatively acknowledged (RabbitMQ) instead of crashing the process. • Rejections escaping `handleMessage` in both transports are routed to `handleError` rather than left unhandled. Workarounds If you cannot upgrade, restrict network access to the transport so that only trusted peers can reach it. Running the process with `--unhandled-rejections=warn` prevents the crash but leaves the message unprocessed and is not a substitute for the fix. Credit Reported by ZeroVuln Labs.