{"id":"CVE-2026-97705","kind":"vulnerability","aliases":["CVE-2026-97705"],"related":[],"title":"Moleculer: crafted TCP packet length hangs Node.js services until restart","description":"Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.","summary":"Moleculer's TCP transporter reads a packet length as a signed integer, so a remote peer can send a negative length that makes the parser loop forever. The synchronous loop blocks the Node.js event loop, freezing every service in the process until it is restarted.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microservices","moleculer","node.js","package","tcp-transporter"],"not_affected_if":["nats-or-other-transporter","tcp-port-not-reachable","tcp-transporter-disabled"],"how_to_check":"- Check the installed version with `npm ls moleculer`.\n- Confirm whether the TCP transporter is enabled in the service broker configuration.\n- Check whether the TCP transporter port is reachable from untrusted networks.","fix":"- Upgrade `moleculer` to `0.14.36` on the 0.14 line.\n- Upgrade `moleculer` to `0.15.2` on the 0.15 line.","status":"open","published_at":"2026-11-04T20:19:13+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","triaged_at":"2026-11-04T20:30:00+00:00","updated_at":"2026-11-04T20:30:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T20:30:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `moleculer` to `0.14.36` on the 0.14 line.\n- Upgrade `moleculer` to `0.15.2` on the 0.15 line.","reach":"network","title":"Moleculer: crafted TCP packet length hangs Node.js services until restart","impact":"medium","summary":"Moleculer's TCP transporter reads a packet length as a signed integer, so a remote peer can send a negative length that makes the parser loop forever. The synchronous loop blocks the Node.js event loop, freezing every service in the process until it is restarted.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","moleculer","microservices","tcp-transporter"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote peer freezes all services in the Node.js process","analyst_note":"","how_to_check":"- Check the installed version with `npm ls moleculer`.\n- Confirm whether the TCP transporter is enabled in the service broker configuration.\n- Check whether the TCP transporter port is reachable from untrusted networks.","plain_action":"","needs_analyst":false,"not_affected_if":["nats-or-other-transporter","tcp-transporter-disabled","tcp-port-not-reachable"],"who_is_affected":"Services built on Moleculer that use the TCP transporter and accept connections from peers that are not fully trusted. Neither CRC validation nor maxPacketSize stops the malformed length, so those settings do not protect against it. Services using other transporters, or with the TCP transporter kept off a reachable network, are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4326,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97705':13A,16A '0':117C '0.14.36':79C,164C '0.15.2':81C,166C 'block':54B,124C 'buffer':112C 'buffer.prototype':86C 'caus':105C 'continu':119C 'could':99C 'craft':2A 'crc':149C 'cve':11A,14A 'enabl':144C 'event':57B,127C 'everi':60B,131C 'fix':161C 'forev':50B 'framework':74C 'freez':59B 'hang':6A 'indefinit':120C 'integ':35B 'issu':159C 'length':5A,31B,44B,93C,107C,156C 'loop':49B,53B,58B,118C,123C,128C 'made':130C 'make':46B 'malform':155C 'maxpackets':152C 'microservic':17B,73C 'molecul':1A,18B,24B,69C 'must':142C 'negat':43B,102C 'neither':148C 'node.js':7A,19B,56B,76C,126C 'packag':20B 'packet':4A,30B,92C 'packet.length':116C 'packet.slice':106C 'parser':48B 'parser._write':82C 'peer':39B,98C 'prevent':153C 'prior':77C 'process':64B,135C 'progress':72C 'reachabl':146C 'read':28B,89C 'readint32be':87C 'remot':38B,96C 'restart':10A,68B,138C 'return':109C 'send':41B 'servic':8A,61B,132C 'sign':34B,91C 'src/transporters/tcp/parser.js':84C 'suppli':100C 'synchron':52B,122C 'tcp':3A,22B,26B,140C 'tcp-transport':21B 'transport':23B,27B,141C 'unauthent':97C 'unchang':111C 'unrespons':136C 'use':85C 'valid':150C 'valu':103C,157C 'version':163C","nicknames":[],"mitigations":[],"who_affected":"Services built on Moleculer that use the TCP transporter and accept connections from peers that are not fully trusted. Neither CRC validation nor maxPacketSize stops the malformed length, so those settings do not protect against it. Services using other transporters, or with the TCP transporter kept off a reachable network, are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microservices","moleculer","nodejs","package","tcptransporter"],"campaign_type":null,"first_public_at":"2026-08-29T20:32:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97705","severity":null,"published_at":"2026-11-04T20:19:13+00:00","modified_at":"2026-11-04T20:19:13+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","fetched_at":"2026-11-04T20:29:03+00:00","note":null}],"documents":[{"id":70211,"url":"https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70212,"url":"https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70213,"url":"https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70214,"url":"https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70215,"url":"https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-29T20:32:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}