Nest.js DoS via Malformed JSON: CVE-2026-40879

The National Vulnerability Database has detailed CVE-2026-40879, a high-severity denial-of-service vulnerability affecting Nest.js, a popular Node.js framework. Prior to version 11.1.19, an attacker can trigger a call stack overflow by sending numerous small, valid JSON messages within a single TCP frame. The handleData() function’s recursive processing, shrinking the buffer with each call, bypasses maxBufferSize limits, leading to a RangeError.

A payload of approximately 47 KB is sufficient to exploit this flaw. The CVSSv3.1 score of 7.5 (High) reflects the complete availability impact (A:H) with no user interaction or privileges required (AV:N/AC:L/PR:N/UI:N). This is a straightforward remote DoS, making it a low-effort, high-impact attack for unpatched systems.

This vulnerability, categorized under CWE-674 (Uncontrolled Recursion), highlights a common pitfall in network application development: inadequate input validation combined with recursive processing. For defenders, this means a direct path to service disruption if your Nest.js applications are not updated. Attackers will prioritize targets with public-facing Nest.js endpoints, as the exploit is simple and effective.