Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@nestjs/microservices

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release
12.4.0 (Nov 6, 2026): no advisory affects it
Newest unaffected release
12.4.0 (Nov 6, 2026), the latest release
Advisories
2 · 2 high
Weekly downloads
3.2M
Dependents
89
Releases
457 since 2.0.0 (May 14, 2017)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-102281
    Affects 2.0.0 to 11.2.3 (11.2.4 is outside it); 12.0.0 to 12.0.1 (12.0.2 is outside it)
  • CVE-2026-40879
    Affects 2.0.0 to 11.1.18 (11.1.19 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • Nest: Remote process termination via a deeply nested microservice message pattern

    Affected: fixed in 11.2.4; from 12.0.0, fixed in 12.0.2.

    Fixed in 11.2.4 (released Sep 14, 2026, 14 days before disclosure) and 12.0.2 (released Sep 14, 2026, 14 days before disclosure).

    The latest release, 12.4.0, is not affected.

    64% of @nestjs/microservices downloads last week were affected versions (2.2M).

  • Nest: DoS via Recursive handleData in JsonSocket (TCP Transport)

    Affected: fixed in 11.1.19.

    Fixed in 11.1.19 (released Apr 13, 2026, 8 days before disclosure).

    The latest release, 12.4.0, is not affected.

    46% of @nestjs/microservices downloads last week were affected versions (1.6M).