CVE-2026-40879

OVERVIEW CVE-2026-40879 affects NestJS, a framework for building scalable Node.js server-side applications, in versions prior to 11.1.19. The vulnerability exists in the handleData() function, which recursively processes JSON messages within a single TCP frame. An attacker can exploit this by sending multiple small, valid JSON messages concatenated in one network packet, causing the function to recurse excessively without triggering the buffer size limit, ultimately resulting in a stack overflow condition. A payload of approximately 47 KB is sufficient to trigger a RangeError and crash the application. SEVERITY This vulnerability has a CVSS v3.1 score of 7.5 (High) with a network-based attack vector requiring no authentication or user interaction. The attack is straightforward to execute with low complexity. The impact is limited to availability, as successful exploitation causes a denial of service through application crash; there are no direct confidentiality or integrity implications. The EPSS score of 0.0004 suggests relatively low probability of exploitation in the wild compared to other vulnerabilities. EXPLOITATION STATUS The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and appears inactive on exploit tracking hot lists. Public exploit code availability and active exploitation in the wild have not been reported. Community attention remains minimal at this time, though organizations running affected NestJS versions should prioritize patching to version 11.1.19 to mitigate denial-of-service risks.