high7.5
CVE-2026-97705
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
Impact
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
An attacker can exploit this over the network, without logging in, without any action by a user. If it succeeds: high risk of outages.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | moleculer | >= 0.15.0-beta1, < 0.15.2 | 0.15.2 |
Affected products · Moleculerjs
| Product | Affected versions |
|---|---|
| Moleculer | before 0.14.36 from 0.15.0, before 0.15.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/moleculerjs/moleculer/commit/168ecbdc245c9a9d1dc4ef9b8a81dbae38ee3063
- https://github.com/moleculerjs/moleculer/commit/914074e502ae403a0338ad168b45b16d6bcc3e44
- https://github.com/moleculerjs/moleculer/releases/tag/v0.14.36
- https://github.com/moleculerjs/moleculer/releases/tag/v0.15.2
- https://github.com/moleculerjs/moleculer/security/advisories/GHSA-h89v-g948-47vp
- https://github.com/advisories/GHSA-h89v-g948-47vp
- https://nvd.nist.gov/vuln/detail/CVE-2026-97705