CVE-2026-40879

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nestjs:nest:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Nest es un framework para construir aplicaciones escalables de Node.js del lado del servidor. Antes de la versión 11.1.19, cuando un atacante envía muchos mensajes JSON pequeños y válidos en una única trama TCP, handleData() recurre una vez por mensaje; el búfer se reduce en cada llamada. maxBufferSize nunca se alcanza; en su lugar, la pila de llamadas se desborda. Una carga útil de ~47 KB es suficiente para activar un RangeError. Esta vulnerabilidad se corrige en la versión 11.1.19.

Information

Published : 2026-04-21 20:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40879

Mitre link : CVE-2026-40879

CVE.ORG link : CVE-2026-40879

JSON object : View

Products Affected

nestjs

nest

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-40879", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40879", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T19:37:57.073705Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nestjs", "product": "nest", "versions": [{"status": "affected", "version": "< 11.1.19"}]}]}], "published": "2026-04-21T20:17:01.533", "references": [{"url": "https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19."}, {"lang": "es", "value": "Nest es un framework para construir aplicaciones escalables de Node.js del lado del servidor. Antes de la versi\u00f3n 11.1.19, cuando un atacante env\u00eda muchos mensajes JSON peque\u00f1os y v\u00e1lidos en una \u00fanica trama TCP, handleData() recurre una vez por mensaje; el b\u00fafer se reduce en cada llamada. maxBufferSize nunca se alcanza; en su lugar, la pila de llamadas se desborda. Una carga \u00fatil de ~47 KB es suficiente para activar un RangeError. Esta vulnerabilidad se corrige en la versi\u00f3n 11.1.19."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nestjs:nest:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "69F1D86B-AA83-40B0-B117-6C9C07E876B1", "versionEndExcluding": "11.1.19"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}