CVE-2026-102281
1 advisory.
npm/@nestjs/microservices CVE-2026-102281: high 7.5, EPSS 0.38%
Nest: Remote process termination via a deeply nested microservice message pattern
Action: Upgrade @nestjs/microservices to 11.2.4 or later.
npm i @nestjs/microservices@11.2.4npm i @nestjs/microservices@12.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 11.2.4 | - |
| 12.0.0 | 12.0.2 | - |
Fixed versions
| 11.2.4 | 12.0.2 |
Sources
- osv: GHSA-m8vh-jmq9-5rjg
- https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg
- https://nvd.nist.gov/vuln/detail/CVE-2026-102281
- https://github.com/nestjs/nest/pull/17737
- https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f
- https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da
- https://github.com/nestjs/nest
- https://github.com/nestjs/nest/releases/tag/v11.2.4
- https://github.com/nestjs/nest/releases/tag/v12.0.2
CVE-2026-102281 · published · modified · JSON