{"action":"Upgrade @nestjs/microservices to 11.2.5 or later.","affected":[{"fixed":"11.2.5","introduced":"0"},{"fixed":"12.0.3","introduced":"12.0.0"}],"component":"@nestjs/microservices","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["11.2.5","12.0.3"],"ghsa_id":"GHSA-96h4-vgxj-gvm2","id":"tcs_01M5KFF148J9KM0YYKNRJSNEGJ","modified_at":"2026-09-30T15:00:05.887593652Z","published_at":"2026-09-30T14:44:21Z","references":["https://osv.dev/vulnerability/GHSA-96h4-vgxj-gvm2","https://github.com/nestjs/nest/security/advisories/GHSA-96h4-vgxj-gvm2","https://github.com/nestjs/nest/pull/17746","https://github.com/nestjs/nest/pull/17749","https://github.com/nestjs/nest/commit/6ca2dd894a6ff964d318724f363061652e822920","https://github.com/nestjs/nest/commit/781843ac98d429fe1d541c52c7126850be5989a7","https://github.com/nestjs/nest/commit/dee4ed4dbc2e18e1e722619927647f5441dfe812","https://github.com/nestjs/nest","https://github.com/nestjs/nest/releases/tag/v11.2.5","https://github.com/nestjs/nest/releases/tag/v12.0.3"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-96h4-vgxj-gvm2","url":"https://osv.dev/vulnerability/GHSA-96h4-vgxj-gvm2"}],"summary":"Nest: Unbounded memory growth in the NestJS TCP microservice transport"}