{"id":"GHSA-m25w-q28w-j8fp","kind":"vulnerability","aliases":["GHSA-m25w-q28w-j8fp"],"related":[],"title":"Process crash via a large WebSocket message to a WsAdapter gateway","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/platform-ws` |\n| Affected versions | `< 11.2.10` and `>= 12.0.0, < 12.5.0` |\n| Patched versions | `11.2.10` and `12.5.0` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (7.5) |\n| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |\n\n### Summary\n\n`WsAdapter` accepted client messages of up to 100 MiB, the `ws` library's default, and parsed each message whole before any handler or guard ran. A single large message from any client that could open a connection could exhaust the heap and terminate the process.\n\n### Impact\n\nApplications that use `@nestjs/platform-ws` (`app.useWebSocketAdapter(new WsAdapter(app))`) without a `maxPayload` in their gateway options are affected. No authentication is needed unless the connection is refused at the upgrade. The default Socket.IO adapter is not affected: engine.io limits messages to 1 MB by default.\n\n### Patches\n\nFixed in **11.2.10** and **12.5.0**. `WsAdapter` now limits client messages to 1 MB by default and closes a connection that sends a larger one with code 1009. A gateway's own `maxPayload` still takes precedence, and the new `maxPayload` option of the adapter changes the default.\n\n### Workarounds\n\nSet `maxPayload` in the options of each `@WebSocketGateway()`.\n\n### Credit\n\nReported by Anthropic's OSS Scanner.","summary":"The NestJS WebSocket adapter @nestjs/platform-ws accepted client messages up to 100 MiB and parsed each one whole before any handler ran. A single large message from a connected client can exhaust memory and terminate the Node.js process, causing a denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/platform-ws","fixed":["12.5.0"],"affected":">= 12.0.0, < 12.5.0","ecosystem":"npm"},{"name":"@nestjs/platform-ws","fixed":["11.2.10"],"affected":"< 11.2.10","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","cwe-770","nestjs","node.js","package","self-hosted","websocket"],"not_affected_if":["auth-required","maxpayload-set","socketio-adapter"],"how_to_check":"- Check the installed version with `npm ls @nestjs/platform-ws`; versions below `11.2.10`, or from `12.0.0` up to but not including `12.5.0`, are affected.\n- Search the code for `new WsAdapter(` and `@WebSocketGateway(` and see whether the gateway options set `maxPayload`; without it the 100 MiB default applies.","fix":"- `@nestjs/platform-ws` `11.2.10` for the 11.x line\n- `@nestjs/platform-ws` `12.5.0` for the 12.x line\n- Until upgrading, set `maxPayload` in the options of each `@WebSocketGateway()` (the advisory's workaround).","status":"open","published_at":"2026-11-12T19:03:48+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","triaged_at":"2026-11-12T19:15:49+00:00","updated_at":"2026-11-12T19:15:49+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-12T19:15:49Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/platform-ws` `11.2.10` for the 11.x line\n- `@nestjs/platform-ws` `12.5.0` for the 12.x line\n- Until upgrading, set `maxPayload` in the options of each `@WebSocketGateway()` (the advisory's workaround).","reach":"internet","title":"NestJS WsAdapter: one large WebSocket message can crash the process","impact":"medium","summary":"The NestJS WebSocket adapter @nestjs/platform-ws accepted client messages up to 100 MiB and parsed each one whole before any handler ran. A single large message from a connected client can exhaust memory and terminate the Node.js process, causing a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","websocket","node.js","self-hosted"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"A single large message crashes the whole Node.js process","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @nestjs/platform-ws`; versions below `11.2.10`, or from `12.0.0` up to but not including `12.5.0`, are affected.\n- Search the code for `new WsAdapter(` and `@WebSocketGateway(` and see whether the gateway options set `maxPayload`; without it the 100 MiB default applies.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["socketio-adapter","maxpayload-set","auth-required"],"who_is_affected":"Applications that use @nestjs/platform-ws through app.useWebSocketAdapter(new WsAdapter(app)) and do not set maxPayload in their gateway options. Any client that can open a WebSocket connection to such a gateway can trigger the crash; the advisory says no authentication is needed unless the connection is refused at the upgrade. Apps using the default Socket.IO adapter are not affected, since engine.io limits messages to 1 MB by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000886,"input_tokens":5164,"output_tokens":740,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':25B,119C '-770':27B,110C '1':210C,226C '100':45B,131C '1009':241C '11.2.10':85C,91C,217C '12.0.0':87C '12.5.0':88C,93C,219C '7.5':107C 'accept':40B,125C 'adapt':38B,202C,257C 'affect':83C,186C,205C 'alloc':111C 'anthrop':273C 'app':177C 'app.usewebsocketadapter':174C 'applic':170C 'authent':188C 'av':98C 'caus':72B 'chang':258C 'client':41B,63B,126C,155C,223C 'close':231C 'code':240C 'connect':62B,160C,193C,233C 'consumpt':122C 'could':157C,161C 'crash':2A 'credit':270C 'cvss':96C 'cwe':24B,26B,108C,109C,118C 'default':137C,200C,213C,229C,260C 'denial':74B 'ecosystem':79C 'engine.io':206C 'exhaust':65B,162C 'field':77C 'fix':215C 'gateway':11A,183C,243C 'ghsa':13A,18A 'ghsa-m25w-q28w-j8fp':12A,17A 'guard':147C 'h':106C 'handler':54B,145C 'heap':164C 'high':95C 'host':33B 'impact':169C 'j8fp':16A,21A 'l/pr':100C 'larg':5A,58B,151C 'larger':237C 'librari':135C 'limit':115C,207C,222C 'm25w':14A,19A 'maxpayload':180C,246C,253C,263C 'mb':211C,227C 'memori':66B 'messag':7A,42B,59B,127C,141C,152C,208C,224C 'mib':46B,132C 'n/a':105C 'n/ac':99C 'n/i':104C 'n/s':102C 'n/ui':101C 'need':190C 'nestj':28B,36B 'nestjs/platform-ws':22A,23A,39B,82C,173C 'new':175C,252C 'node.js':29B,70B 'npm':80C 'one':50B,238C 'open':158C 'option':184C,254C,266C 'oss':275C 'packag':30B,81C 'pars':48B,139C 'patch':89C,214C 'preced':249C 'process':1A,71B,168C 'q28w':15A,20A 'ran':55B,148C 'refus':195C 'report':271C 'resourc':113C,121C 'scanner':276C 'self':32B 'self-host':31B 'send':235C 'servic':76B 'set':262C 'sever':94C 'singl':57B,150C 'socket.io':201C 'still':247C 'summari':123C 'take':248C 'termin':68B,166C 'throttl':117C 'u/c':103C 'uncontrol':120C 'unless':191C 'upgrad':198C 'use':172C 'v3.1':97C 'valu':78C 'version':84C,90C 'via':3A 'websocket':6A,34B,37B 'websocketgateway':269C 'whole':51B,142C 'without':114C,178C 'workaround':261C 'ws':134C 'wsadapt':10A,124C,176C,220C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @nestjs/platform-ws through app.useWebSocketAdapter(new WsAdapter(app)) and do not set maxPayload in their gateway options. Any client that can open a WebSocket connection to such a gateway can trigger the crash; the advisory says no authentication is needed unless the connection is refused at the upgrade. Apps using the default Socket.IO adapter are not affected, since engine.io limits messages to 1 MB by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["platformws"],"ptokens":["nestjs","platform","ws"],"labels":["cwe400","cwe770","high","nestjs","nodejs","npm","package","selfhosted","websocket"],"campaign_type":null,"search_a":"'crash':2A 'gateway':11A 'ghsa':13A,18A 'ghsa-m25w-q28w-j8fp':12A,17A 'j8fp':16A,21A 'larg':5A 'm25w':14A,19A 'messag':7A 'nestjs/platform-ws':22A,23A 'process':1A 'q28w':15A,20A 'via':3A 'websocket':6A 'wsadapt':10A","search_b":"'-400':25B '-770':27B '100':45B 'accept':40B 'adapt':38B 'caus':72B 'client':41B,63B 'connect':62B 'cwe':24B,26B 'denial':74B 'exhaust':65B 'handler':54B 'host':33B 'larg':58B 'memori':66B 'messag':42B,59B 'mib':46B 'nestj':28B,36B 'nestjs/platform-ws':39B 'node.js':29B,70B 'one':50B 'packag':30B 'pars':48B 'process':71B 'ran':55B 'self':32B 'self-host':31B 'servic':76B 'singl':57B 'termin':68B 'websocket':34B,37B 'whole':51B","search_c":"'-400':119C '-770':110C '1':210C,226C '100':131C '1009':241C '11.2.10':85C,91C,217C '12.0.0':87C '12.5.0':88C,93C,219C '7.5':107C 'accept':125C 'adapt':202C,257C 'affect':83C,186C,205C 'alloc':111C 'anthrop':273C 'app':177C 'app.usewebsocketadapter':174C 'applic':170C 'authent':188C 'av':98C 'chang':258C 'client':126C,155C,223C 'close':231C 'code':240C 'connect':160C,193C,233C 'consumpt':122C 'could':157C,161C 'credit':270C 'cvss':96C 'cwe':108C,109C,118C 'default':137C,200C,213C,229C,260C 'ecosystem':79C 'engine.io':206C 'exhaust':162C 'field':77C 'fix':215C 'gateway':183C,243C 'guard':147C 'h':106C 'handler':145C 'heap':164C 'high':95C 'impact':169C 'l/pr':100C 'larg':151C 'larger':237C 'librari':135C 'limit':115C,207C,222C 'maxpayload':180C,246C,253C,263C 'mb':211C,227C 'messag':127C,141C,152C,208C,224C 'mib':132C 'n/a':105C 'n/ac':99C 'n/i':104C 'n/s':102C 'n/ui':101C 'need':190C 'nestjs/platform-ws':82C,173C 'new':175C,252C 'npm':80C 'one':238C 'open':158C 'option':184C,254C,266C 'oss':275C 'packag':81C 'pars':139C 'patch':89C,214C 'preced':249C 'process':168C 'ran':148C 'refus':195C 'report':271C 'resourc':113C,121C 'scanner':276C 'send':235C 'set':262C 'sever':94C 'singl':150C 'socket.io':201C 'still':247C 'summari':123C 'take':248C 'termin':166C 'throttl':117C 'u/c':103C 'uncontrol':120C 'unless':191C 'upgrad':198C 'use':172C 'v3.1':97C 'valu':78C 'version':84C,90C 'websocketgateway':269C 'whole':142C 'without':114C,178C 'workaround':261C 'ws':134C 'wsadapt':124C,176C,220C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:03:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-m25w-q28w-j8fp","url":"https://github.com/nestjs/nest/security/advisories/GHSA-m25w-q28w-j8fp","severity":"high","published_at":"2026-11-12T19:03:48+00:00","modified_at":"2026-11-12T19:03:48+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","fetched_at":"2026-11-12T19:14:24+00:00","note":null}],"documents":[{"id":137722,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-m25w-q28w-j8fp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}