@NESTJS/WEBSOCKETS · GHSA-pqx8-96w4-q4w8 · Package
FIX → 12.5.0 · 11.2.10
The default WebSocket exception filter in NestJS echoes a failed message's data back in its error reply, and with the Socket.IO adapter a crafted binary message can make that reply much larger than the message itself. Sending it can exhaust memory and terminate the Node.js process, and no login is needed.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications using the NestJS WebSocket gateways with the default Socket.IO adapter and the default exception filter, or a filter that extends BaseWsExceptionFilter and keeps includeCause. Any message handler that can fail for a client (a guard refusing it or a pipe rejecting the payload) is a trigger. Apps not using WebSockets, or with includeCause disabled, can skip it.
Not affected if custom-exception-filter, includecause-false, no-websockets
Who cares nestjs, node, socket.io, websockets
npm ls @nestjs/websockets @nestjs/platform-socket.ioBaseWsExceptionFilter with left on| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/websockets, @nestjs/platform-socket.io |
| Affected versions | >= 11.0.0, < 11.2.10 and >= 12.0.0, < 12.5.0 |
| Patched versions | 11.2.10 and 12.5.0 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
includeCauseUpgrade to 12.5.0 · 11.2.10
@nestjs/websockets: 11.2.10 on the 11.x line, 12.5.0 on the 12.x line@nestjs/platform-socket.io: 11.2.10 on the 11.x line, 12.5.0 on the 12.x lineBaseWsExceptionFilter with includeCause: false| CWE | CWE-405 (Asymmetric Resource Consumption (Amplification)), CWE-400 (Uncontrolled Resource Consumption) |
By default, the WebSocket exception filter includes the data of the message that failed in its error reply. With the Socket.IO adapter, a crafted message with binary data could make that reply far larger than the message itself, and sending it could exhaust memory or terminate the process.
Applications using the default Socket.IO adapter and the default WebSocket exception filter (or one that extends BaseWsExceptionFilter and keeps includeCause) are affected when any message handler can fail for a client, for example because a guard refuses it or a pipe rejects the payload. No authentication is needed.
Fixed in 11.2.10 and 12.5.0. The default filter leaves binary data out of the cause of its error replies, and IoAdapter disconnects a client whose message refers to the same binary value more than once. Upgrade both @nestjs/websockets and @nestjs/platform-socket.io.
Use an exception filter that does not include the cause, for example one that extends BaseWsExceptionFilter with includeCause: false.
Reported by Anthropic's OSS Scanner.