NestJS versions before 11.2.4 and between 12.0.0 and 12.0.2 are vulnerable to a denial-of-service condition when handling messages with deeply nested objects in their pattern. The ServerTCP#handleMessage and ServerRMQ#handleMessage methods use JSON.stringify on a client-controlled non-string pattern to derive a handler lookup key. Deep nesting causes a RangeError: Maximum call stack size exceeded, which is not caught, leading to an unhandled promise rejection that terminates the Node.js process. This vulnerability affects microservices using TCP or RabbitMQ transports but not other transports where patterns arrive as strings. The vulnerability is resolved in versions 11.2.4 and 12.0.2.

An attacker with network access to the TCP port or the ability to publish messages to the RabbitMQ queue or exchange can cause a denial-of-service by crashing the NestJS microservice. This results in service unavailability due to the Node.js process termination. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade affected NestJS versions to 11.2.4 or later, or 12.0.2 or later, where this issue is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory.