---
id: "CVE-2026-97705"
kind: "vulnerability"
aliases: ["CVE-2026-97705"]
title: "Moleculer: crafted TCP packet length hangs Node.js services until restart"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["microservices", "moleculer", "node.js", "package", "tcp-transporter"]
not_affected_if: ["nats-or-other-transporter", "tcp-port-not-reachable", "tcp-transporter-disabled"]
published_at: "2026-11-04T20:19:13+00:00"
first_seen_at: "2026-11-04T20:29:03+00:00"
updated_at: "2026-11-04T20:30:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97705", "first_seen_at": "2026-11-04T20:29:03+00:00"}]
---

# Moleculer: crafted TCP packet length hangs Node.js services until restart

Moleculer's TCP transporter reads a packet length as a signed integer, so a remote peer can send a negative length that makes the parser loop forever. The synchronous loop blocks the Node.js event loop, freezing every service in the process until it is restarted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls moleculer`.
- Confirm whether the TCP transporter is enabled in the service broker configuration.
- Check whether the TCP transporter port is reachable from untrusted networks.

## Fix

- Upgrade `moleculer` to `0.14.36` on the 0.14 line.
- Upgrade `moleculer` to `0.15.2` on the 0.15 line.

## Timeline

- 2026-11-04T20:29:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97705

## Documents

- [advisory] Vendor advisory: github.com https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp
- [fix] Patch: github.com https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063
- [fix] Patch: github.com https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44
- [fix] Release notes: github.com https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36
- [fix] Release notes: github.com https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2

## From the sources

Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_