Threats tagged 'ghsa-h89v-g948-47vp'

Moleculer versions prior to 0.15.2 and 0.14.36 contain a vulnerability in the TCP transporter's packet parser that allows an unauthenticated remote attacker to cause a denial of service. By sending a crafted TCP packet with a negative length field, the parser enters an infinite synchronous loop, blocking the Node.js event loop and rendering the service unresponsive until restarted.