Buffer Overflow in Nest Framework for Node.js Applications

CVE-2026-40879

What is CVE-2026-40879?

The Nest framework, widely used for building scalable Node.js server-side applications, is susceptible to a buffer overflow vulnerability in versions before 11.1.19. When an attacker sends multiple small, valid JSON messages within a single TCP frame, the handleData() method can cause a recursive call per message. As the call stack shrinks with each iteration, the maximum buffer size is never reached, leading to a stack overflow condition. A payload of approximately 47 KB can trigger a RangeError. This security flaw has been addressed in version 11.1.19 with appropriate measures implemented to enhance stability and security.

References