{"action":"Upgrade @nestjs/microservices to 11.2.4 or later.","affected":[{"fixed":"11.2.4","introduced":"0"},{"fixed":"12.0.2","introduced":"12.0.0"}],"component":"@nestjs/microservices","cve_ids":["CVE-2026-102281"],"ecosystem":"npm","epss":0.00586,"exploited":false,"fixed_versions":["11.2.4","12.0.2"],"ghsa_id":"GHSA-m8vh-jmq9-5rjg","id":"tcs_01M5KG07MGFH1R8HETJ41XVZ3F","modified_at":"2026-09-30T00:00:03.849760028Z","published_at":"2026-09-29T23:54:44Z","references":["https://osv.dev/vulnerability/GHSA-m8vh-jmq9-5rjg","https://github.com/nestjs/nest/security/advisories/GHSA-m8vh-jmq9-5rjg","https://nvd.nist.gov/vuln/detail/CVE-2026-102281","https://github.com/nestjs/nest/pull/17737","https://github.com/nestjs/nest/commit/aa97b5144d8dff1ce700aac521eb86449a679d6f","https://github.com/nestjs/nest/commit/e9dcd4c7ac64361fbfe79461da85f5b3fc3e02da","https://github.com/nestjs/nest","https://github.com/nestjs/nest/releases/tag/v11.2.4","https://github.com/nestjs/nest/releases/tag/v12.0.2"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-m8vh-jmq9-5rjg","url":"https://osv.dev/vulnerability/GHSA-m8vh-jmq9-5rjg"}],"summary":"Nest: Remote process termination via a deeply nested microservice message pattern"}