CVE-2026-97705 with a CVSS score of 7.5 is a denial-of-service vulnerability in the Moleculer TCP transporter packet parser, specifically Parser._write in src/transporters/tcp/parser.js. Affected versions are moleculer (npm) versions >= 0.15.0-beta1, < 0.15.2 and moleculer (npm) versions < 0.14.36. The flaw is a signed integer handling issue, classified as CWE-835, where the packet length field is read with Buffer.prototype.readInt32BE, allowing a crafted packet to produce a negative length. When the parser slices the buffer using that negative value, the slice operation clamps the start index to zero, leaving the buffer unchanged. The while loop that processes remaining bytes therefore never terminates, creating an infinite synchronous loop. An unauthenticated remote attacker who can reach the TCP transporter listening port can send a small crafted packet before any handshake or authentication, causing the Node.js event loop to block indefinitely. Because Node.js is single-threaded, the affected process becomes unresponsive, taking down every service hosted in it until forced restart. The business impact is loss of availability for Moleculer nodes and dependent applications, potentially disrupting distributed services, APIs, or internal systems that rely on the affected process.
We recommend you to update Moleculer to version 0.15.2 or 0.14.36 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-97705 with a CVSS score of 7.5 is a denial-of-service vulnerability in the Moleculer TCP transporter packet parser, specifically Parser._write in src/transporters/tcp/parser.js. Affected versions are moleculer (npm) versions >= 0.15.0-beta1, < 0.15.2 and moleculer (npm) versions < 0.14.36. The flaw is a signed integer handling issue, classified as CWE-835, where the packet length field is read with Buffer.prototype.readInt32BE, allowing a crafted packet to produce a negative length. When the parser slices the buffer using that negative value, the slice operation clamps the start index to zero, leaving the buffer unchanged. The while loop that processes remaining bytes therefore never terminates, creating an infinite synchronous loop. An unauthenticated remote attacker who can reach the TCP transporter listening port can send a small crafted packet before any handshake or authentication, causing the Node.js event loop to block indefinitely. Because Node.js is single-threaded, the affected process becomes unresponsive, taking down every service hosted in it until forced restart. The business impact is loss of availability for Moleculer nodes and dependent applications, potentially disrupting distributed services, APIs, or internal systems that rely on the affected process.
We recommend you to update Moleculer to version 0.15.2 or 0.14.36 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]