CVE-2026-97705

Name of the Vulnerable Software and Affected Versions Moleculer versions prior to 0.14.36 Moleculer versions prior to 0.15.2

Description A flaw exists in the TCP transporter where the Parser. write function in src/transporters/tcp/parser.js utilizes Buffer.prototype.readInt32BE to read a signed packet length. A remote unauthenticated peer can provide a negative value, causing packet.slice(length) to return the original buffer. This results in an infinite while (packet.length > 0) loop that blocks the Node.js event loop, rendering all services in the process unresponsive until a restart occurs. This occurs when the TCP transporter is enabled and reachable, as CRC validation and maxPacketSize do not prevent the use of a malformed length value.

Recommendations Update to version 0.14.36. Update to version 0.15.2.