Denial of Service Vulnerability in Moleculer Microservices Framework
CVE-2026-97705
7.5HIGH
What is CVE-2026-97705?
A vulnerability exists in the Moleculer microservices framework for Node.js that allows a remote unauthenticated attacker to cause a denial of service. Specifically, the issue lies within the Parser._write method of the TCP transport layer, where improper handling of packet lengths can lead to infinite loops in the processing of packets. This occurs when a negative length is supplied, leading to an unresponsive event loop and making all services in the Node.js instance unresponsive until a restart occurs. The flaw is mitigated in versions 0.14.36 and 0.15.2, and it is critical for users to upgrade to these versions to safeguard against potential exploitation.
Affected Version(s)
moleculer >= 0.15.0, < 0.15.2 < 0.15.0, 0.15.2
moleculer < 0.14.36 < 0.14.36