@NESTJS/PLATFORM-WS · GHSA-m25w-q28w-j8fp · Package
FIX → 12.5.0 · 11.2.10
The NestJS WebSocket adapter @nestjs/platform-ws accepted client messages up to 100 MiB and parsed each one whole before any handler ran. A single large message from a connected client can exhaust memory and terminate the Node.js process, causing a denial of service.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use @nestjs/platform-ws through app.useWebSocketAdapter(new WsAdapter(app)) and do not set maxPayload in their gateway options. Any client that can open a WebSocket connection to such a gateway can trigger the crash; the advisory says no authentication is needed unless the connection is refused at the upgrade. Apps using the default Socket.IO adapter are not affected, since engine.io limits messages to 1 MB by default.
Not affected if auth-required, maxpayload-set, socketio-adapter
Who cares nestjs, node.js, self-hosted, websocket
npm ls @nestjs/platform-ws; versions below 11.2.10, or from 12.0.0 up to but not including 12.5.0, are affected.new WsAdapter( and @WebSocketGateway( and see whether the gateway options set ; without it the 100 MiB default applies.| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/platform-ws |
| Affected versions | < 11.2.10 and >= 12.0.0, < 12.5.0 |
| Patched versions | 11.2.10 and 12.5.0 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
maxPayloadUpgrade to 12.5.0 · 11.2.10
@nestjs/platform-ws 11.2.10 for the 11.x line@nestjs/platform-ws 12.5.0 for the 12.x linemaxPayload in the options of each @WebSocketGateway() (the advisory's workaround).WsAdapter accepted client messages of up to 100 MiB, the ws library's default, and parsed each message whole before any handler or guard ran. A single large message from any client that could open a connection could exhaust the heap and terminate the process.
Applications that use @nestjs/platform-ws (app.useWebSocketAdapter(new WsAdapter(app))) without a maxPayload in their gateway options are affected. No authentication is needed unless the connection is refused at the upgrade. The default Socket.IO adapter is not affected: engine.io limits messages to 1 MB by default.
Fixed in 11.2.10 and 12.5.0. WsAdapter now limits client messages to 1 MB by default and closes a connection that sends a larger one with code 1009. A gateway's own maxPayload still takes precedence, and the new maxPayload option of the adapter changes the default.
Set maxPayload in the options of each @WebSocketGateway().
Reported by Anthropic's OSS Scanner.