What is the CVSS score of CVE-2026-40879?

CVE-2026-40879 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Nest.js are affected by CVE-2026-40879?

Nest.js applications running versions before 11.1.19 are vulnerable to unauthenticated remote denial-of-service attacks where attackers can crash services by sending specially crafted fragmented JSON…. A patch is available.

How to fix or mitigate CVE-2026-40879?

Within 24 hours: Identify all Nest.js instances in production and staging environments and document current versions. Within 7 days: Apply Nest.js patch to version 11.1.19 or later on all affected instances, beginning with non-production environments. Validate patched versions in staging before production deployment. Within 30 days: Complete production patching of all Nest.js applications and validate stability through monitoring.

Nest.js CVE-2026-40879

HIGH

Uncontrolled Recursion (CWE-674)

2026-04-21 GitHub_M

GHSA-hpwf-8g29-85qm

Buffer Overflow Node.js Nest NestJS

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 20:50 vuln.today

Patch released

Apr 21, 2026 - 20:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 20:00 vuln.today

CVE Published

Apr 21, 2026 - 19:14 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on @nestjs/microservices (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 11.1.19.

DescriptionGitHub Advisory

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.

AnalysisAI

Remote attackers can crash Nest.js applications (versions prior to 11.1.19) by sending approximately 47 KB of fragmented JSON messages within a single TCP frame, triggering a call stack overflow. The handleData() function's recursive processing of small valid JSON messages causes stack exhaustion before maxBufferSize limits are enforced, resulting in RangeError and denial of service. No authentication required (CVSS AV:N/PR:N). Vendor patch released in version 11.1.19. EPSS data not available; no confirmed active exploitation (not in CISA KEV).

Technical ContextAI

Nest.js is a progressive Node.js framework for building server-side applications, using TypeScript and following Angular-like architectural patterns. This vulnerability (CWE-674: Uncontrolled Recursion) resides in the TCP message parsing layer where handleData() processes incoming data streams. When multiple small, well-formed JSON messages arrive concatenated in a single TCP frame, the parser enters recursive processing-shrinking the buffer incrementally with each parsed message rather than iterating. The recursion depth correlates with message count, not total payload size, allowing attackers to bypass the maxBufferSize protection mechanism entirely. The call stack exhausts before buffer size limits trigger, causing JavaScript runtime RangeError exceptions that crash the Node.js process.

RemediationAI

Upgrade Nest.js to version 11.1.19 or later, which implements iterative message processing to prevent call stack overflow. Update package.json dependency to "@nestjs/core": "^11.1.19" and run npm install or yarn install, followed by application restart. Review the GitHub security advisory at https://github.com/nestjs/nest/security/advisories/GHSA-hpwf-8g29-85qm for complete upgrade instructions. If immediate patching is not feasible, implement compensating controls: (1) Deploy application-layer rate limiting to restrict TCP connections per source IP (limit 10 connections/minute), which reduces attack surface but may impact legitimate high-volume clients; (2) Configure upstream reverse proxy (nginx/HAProxy) with client_body_buffer_size limits and connection timeouts to reject oversized or slow requests-note this may false-positive on mobile clients with variable connectivity; (3) Enable process monitoring with automatic restart policies (PM2, Kubernetes liveness probes) to recover from crashes within seconds, though this only mitigates availability impact without preventing exploitation.