{"id":"GHSA-pqx8-96w4-q4w8","kind":"vulnerability","aliases":["GHSA-pqx8-96w4-q4w8"],"related":[],"title":"Process crash via Socket.IO error replies that echo a message's binary data","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/websockets`, `@nestjs/platform-socket.io` |\n| Affected versions | `>= 11.0.0, < 11.2.10` and `>= 12.0.0, < 12.5.0` |\n| Patched versions | `11.2.10` and `12.5.0` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (7.5) |\n| CWE | CWE-405 (Asymmetric Resource Consumption (Amplification)), CWE-400 (Uncontrolled Resource Consumption) |\n\n### Summary\n\nBy default, the WebSocket exception filter includes the data of the message that failed in its error reply. With the Socket.IO adapter, a crafted message with binary data could make that reply far larger than the message itself, and sending it could exhaust memory or terminate the process.\n\n### Impact\n\nApplications using the default Socket.IO adapter and the default WebSocket exception filter (or one that extends `BaseWsExceptionFilter` and keeps `includeCause`) are affected when any message handler can fail for a client, for example because a guard refuses it or a pipe rejects the payload. No authentication is needed.\n\n### Patches\n\nFixed in **11.2.10** and **12.5.0**. The default filter leaves binary data out of the cause of its error replies, and `IoAdapter` disconnects a client whose message refers to the same binary value more than once. Upgrade both `@nestjs/websockets` and `@nestjs/platform-socket.io`.\n\n### Workarounds\n\nUse an exception filter that does not include the cause, for example one that extends `BaseWsExceptionFilter` with `includeCause: false`.\n\n### Credit\n\nReported by Anthropic's OSS Scanner.","summary":"The default WebSocket exception filter in NestJS echoes a failed message's data back in its error reply, and with the Socket.IO adapter a crafted binary message can make that reply much larger than the message itself. Sending it can exhaust memory and terminate the Node.js process, and no login is needed.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/websockets","fixed":["12.5.0"],"affected":">= 12.0.0, < 12.5.0","ecosystem":"npm"},{"name":"@nestjs/websockets","fixed":["11.2.10"],"affected":">= 11.0.0, < 11.2.10","ecosystem":"npm"},{"name":"@nestjs/platform-socket.io","fixed":["12.5.0"],"affected":">= 12.0.0, < 12.5.0","ecosystem":"npm"},{"name":"@nestjs/platform-socket.io","fixed":["11.2.10"],"affected":">= 11.0.0, < 11.2.10","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","cwe-405","nestjs","node","package","socket.io","websockets"],"not_affected_if":["custom-exception-filter","includecause-false","no-websockets"],"how_to_check":"- Check the installed versions with `npm ls @nestjs/websockets @nestjs/platform-socket.io`\n- Look for WebSocket gateways that use the default exception filter or a filter extending `BaseWsExceptionFilter` with `includeCause` left on\n- Confirm whether the app uses the default Socket.IO adapter","fix":"- `@nestjs/websockets`: `11.2.10` on the 11.x line, `12.5.0` on the 12.x line\n- `@nestjs/platform-socket.io`: `11.2.10` on the 11.x line, `12.5.0` on the 12.x line\n- Workaround from the advisory: an exception filter extending `BaseWsExceptionFilter` with `includeCause: false`","status":"open","published_at":"2026-11-12T19:03:51+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","triaged_at":"2026-11-12T19:15:45+00:00","updated_at":"2026-11-12T19:15:45+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T19:15:45Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/websockets`: `11.2.10` on the 11.x line, `12.5.0` on the 12.x line\n- `@nestjs/platform-socket.io`: `11.2.10` on the 11.x line, `12.5.0` on the 12.x line\n- Workaround from the advisory: an exception filter extending `BaseWsExceptionFilter` with `includeCause: false`","reach":"internet","title":"NestJS WebSockets: error replies echo binary data, can crash the process","impact":"medium","summary":"The default WebSocket exception filter in NestJS echoes a failed message's data back in its error reply, and with the Socket.IO adapter a crafted binary message can make that reply much larger than the message itself. Sending it can exhaust memory and terminate the Node.js process, and no login is needed.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","websockets","socket.io","node"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Remote clients crash the Node.js server process via memory exhaustion","analyst_note":"","how_to_check":"- Check the installed versions with `npm ls @nestjs/websockets @nestjs/platform-socket.io`\n- Look for WebSocket gateways that use the default exception filter or a filter extending `BaseWsExceptionFilter` with `includeCause` left on\n- Confirm whether the app uses the default Socket.IO adapter","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-websockets","includecause-false","custom-exception-filter"],"who_is_affected":"Applications using the NestJS WebSocket gateways with the default Socket.IO adapter and the default exception filter, or a filter that extends BaseWsExceptionFilter and keeps includeCause. Any message handler that can fail for a client (a guard refusing it or a pipe rejecting the payload) is a trigger. Apps not using WebSockets, or with includeCause disabled, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000902,"input_tokens":5293,"output_tokens":746,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':29B,130C '-405':31B,124C '11.0.0':98C '11.2.10':99C,105C,235C '12.0.0':101C '12.5.0':102C,107C,237C '7.5':121C '96w4':17A,22A 'adapt':59B,156C,189C 'affect':96C,205C 'amplif':128C 'anthrop':296C 'applic':184C 'asymmetr':125C 'authent':229C 'av':112C 'back':50B 'basewsexceptionfilt':200C,289C 'binari':12A,62B,161C,242C,263C 'caus':247C,283C 'client':214C,256C 'consumpt':127C,133C 'could':163C,176C 'craft':61B,158C 'crash':2A 'credit':293C 'cvss':110C 'cwe':28B,30B,122C,123C,129C 'data':13A,49B,143C,162C,243C 'default':38B,136C,187C,192C,239C 'disconnect':254C 'echo':8A,44B 'ecosystem':91C 'error':5A,53B,151C,250C 'exampl':216C,285C 'except':40B,139C,194C,276C 'exhaust':77B,177C 'extend':199C,288C 'fail':46B,148C,211C 'fals':292C 'far':167C 'field':89C 'filter':41B,140C,195C,240C,277C 'fix':233C 'ghsa':15A,20A 'ghsa-pqx8-96w4-q4w8':14A,19A 'guard':219C 'h':120C 'handler':209C 'high':109C 'impact':183C 'includ':141C,281C 'includecaus':203C,291C 'ioadapt':253C 'keep':202C 'l/pr':114C 'larger':69B,168C 'leav':241C 'login':86B 'make':65B,164C 'memori':78B,178C 'messag':10A,47B,63B,72B,146C,159C,171C,208C,258C 'much':68B 'n/a':119C 'n/ac':113C 'n/i':118C 'n/s':116C 'n/ui':115C 'need':88B,231C 'nestj':32B,43B 'nestjs/platform-socket.io':26A,27A,95C,272C 'nestjs/websockets':24A,25A,94C,270C 'node':33B 'node.js':82B 'npm':92C 'one':197C,286C 'oss':298C 'packag':34B,93C 'patch':103C,232C 'payload':227C 'pipe':224C 'pqx8':16A,21A 'process':1A,83B,182C 'q4w8':18A,23A 'refer':259C 'refus':220C 'reject':225C 'repli':6A,54B,67B,152C,166C,251C 'report':294C 'resourc':126C,132C 'scanner':299C 'send':74B,174C 'sever':108C 'socket.io':4A,35B,58B,155C,188C 'summari':134C 'termin':80B,180C 'u/c':117C 'uncontrol':131C 'upgrad':268C 'use':185C,274C 'v3.1':111C 'valu':90C,264C 'version':97C,104C 'via':3A 'websocket':36B,39B,138C,193C 'whose':257C 'workaround':273C","nicknames":[],"mitigations":[],"who_affected":"Applications using the NestJS WebSocket gateways with the default Socket.IO adapter and the default exception filter, or a filter that extends BaseWsExceptionFilter and keeps includeCause. Any message handler that can fail for a client (a guard refusing it or a pipe rejecting the payload) is a trigger. Apps not using WebSockets, or with includeCause disabled, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["platformsocketio","websockets"],"ptokens":["io","nestjs","platform","socket","websockets"],"labels":["cwe400","cwe405","high","nestjs","node","npm","package","socketio","websockets"],"campaign_type":null,"search_a":"'96w4':17A,22A 'binari':12A 'crash':2A 'data':13A 'echo':8A 'error':5A 'ghsa':15A,20A 'ghsa-pqx8-96w4-q4w8':14A,19A 'messag':10A 'nestjs/platform-socket.io':26A,27A 'nestjs/websockets':24A,25A 'pqx8':16A,21A 'process':1A 'q4w8':18A,23A 'repli':6A 'socket.io':4A 'via':3A","search_b":"'-400':29B '-405':31B 'adapt':59B 'back':50B 'binari':62B 'craft':61B 'cwe':28B,30B 'data':49B 'default':38B 'echo':44B 'error':53B 'except':40B 'exhaust':77B 'fail':46B 'filter':41B 'larger':69B 'login':86B 'make':65B 'memori':78B 'messag':47B,63B,72B 'much':68B 'need':88B 'nestj':32B,43B 'node':33B 'node.js':82B 'packag':34B 'process':83B 'repli':54B,67B 'send':74B 'socket.io':35B,58B 'termin':80B 'websocket':36B,39B","search_c":"'-400':130C '-405':124C '11.0.0':98C '11.2.10':99C,105C,235C '12.0.0':101C '12.5.0':102C,107C,237C '7.5':121C 'adapt':156C,189C 'affect':96C,205C 'amplif':128C 'anthrop':296C 'applic':184C 'asymmetr':125C 'authent':229C 'av':112C 'basewsexceptionfilt':200C,289C 'binari':161C,242C,263C 'caus':247C,283C 'client':214C,256C 'consumpt':127C,133C 'could':163C,176C 'craft':158C 'credit':293C 'cvss':110C 'cwe':122C,123C,129C 'data':143C,162C,243C 'default':136C,187C,192C,239C 'disconnect':254C 'ecosystem':91C 'error':151C,250C 'exampl':216C,285C 'except':139C,194C,276C 'exhaust':177C 'extend':199C,288C 'fail':148C,211C 'fals':292C 'far':167C 'field':89C 'filter':140C,195C,240C,277C 'fix':233C 'guard':219C 'h':120C 'handler':209C 'high':109C 'impact':183C 'includ':141C,281C 'includecaus':203C,291C 'ioadapt':253C 'keep':202C 'l/pr':114C 'larger':168C 'leav':241C 'make':164C 'memori':178C 'messag':146C,159C,171C,208C,258C 'n/a':119C 'n/ac':113C 'n/i':118C 'n/s':116C 'n/ui':115C 'need':231C 'nestjs/platform-socket.io':95C,272C 'nestjs/websockets':94C,270C 'npm':92C 'one':197C,286C 'oss':298C 'packag':93C 'patch':103C,232C 'payload':227C 'pipe':224C 'process':182C 'refer':259C 'refus':220C 'reject':225C 'repli':152C,166C,251C 'report':294C 'resourc':126C,132C 'scanner':299C 'send':174C 'sever':108C 'socket.io':155C,188C 'summari':134C 'termin':180C 'u/c':117C 'uncontrol':131C 'upgrad':268C 'use':185C,274C 'v3.1':111C 'valu':90C,264C 'version':97C,104C 'websocket':138C,193C 'whose':257C 'workaround':273C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:03:51+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-pqx8-96w4-q4w8","url":"https://github.com/nestjs/nest/security/advisories/GHSA-pqx8-96w4-q4w8","severity":"high","published_at":"2026-11-12T19:03:51+00:00","modified_at":"2026-11-12T19:03:51+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","fetched_at":"2026-11-12T19:14:24+00:00","note":null}],"documents":[{"id":137721,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-pqx8-96w4-q4w8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}