CVE-2026-97705 · Package
NO FIX YET · SEE WHAT TO DO
Moleculer's TCP transporter reads a packet length as a signed integer, so a remote peer can send a negative length that makes the parser loop forever. The synchronous loop blocks the Node.js event loop, freezing every service in the process until it is restarted.
first public Aug 29, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Services built on Moleculer that use the TCP transporter and accept connections from peers that are not fully trusted. Neither CRC validation nor maxPacketSize stops the malformed length, so those settings do not protect against it. Services using other transporters, or with the TCP transporter kept off a reachable network, are not exposed through this path.
Not affected if nats-or-other-transporter, tcp-port-not-reachable, tcp-transporter-disabled
Who cares microservices, moleculer, node.js, tcp-transporter
npm ls moleculer.moleculer to 0.14.36 on the 0.14 line.moleculer to 0.15.2 on the 0.15 line.Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-97705") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.