Zerovulnlabs

**Name of the Vulnerable Software and Affected Versions** Nest versions prior to 11.2.4 Nest versions prior to 12.0.2 **Description** A microservice using TCP or RabbitMQ transport can be terminated by a single message containing a deeply nested object in its pattern. The functions `ServerTCP#handleMessage()` and `ServerRMQ#handleMessage()` pass a client-controlled non-string pattern to `JSON.stringify()` to derive the handler lookup key. Sufficiently deep nesting triggers a RangeError: Maximum call stack size exceeded, leading to an unhandled promise rejection that crashes the Node.js process. This allows an attacker with access to the TCP port or the ability to publish to the consumed RabbitMQ queue or exchange to cause a denial of service. **Recommendations** Update to version 11.2.4 or later. Update to version 12.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastify versions prior to 5.12.5 **Description** When a route registers a response trailer using the `reply.trailer()` function and is served over HTTP/2, the framework unconditionally sets the Transfer-Encoding: chunked header. Because this header is forbidden in HTTP/2, Node.js throws an exception during the serialization of response headers. This exception is not caught, resulting in an uncaughtException that crashes the server process and drops all in-flight requests. A single unauthenticated HTTP/2 request to any route utilizing trailers can trigger this crash, which can be repeated after every server restart. **Recommendations** Update to version 5.12.5 or later. As a temporary workaround, avoid registering response trailers with the `reply.trailer()` function on routes served over HTTP/2.