- Severity: HIGH
- CVE: CVE-2026-97705
- Ecosystems: npm, npm
- Packages: moleculer, moleculer
### Summary
The TCP transporter’s packet parser (`src/transporters/tcp/parser.js`) reads the packet length field with `Buffer.prototype.readInt32BE`, a signed read. A crafted packet whose length field has the sign bit set yields a negative `length`. The parser then advances past the parsed message with `packet = packet.slice(length)`, but `Buffer.prototype.slice` clamps an out-of-range negative start index to `0`, so the buffer is returned unchanged. The `while (packet.length > 0)` loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely.
### Impact
Any Moleculer node using the TCP transporter can be rendered completely unresponsive by an unauthenticated remote peer sending a single ~10-byte crafted TCP packet, before any protocol handshake or authentication takes place. `TcpReader.onTcpClientConnected` pipes each accepted socket’s bytes straight into a fresh `Parser` instance (`socket.pipe(parser)`) with no handshake, so the code path is reachable by any peer able to reach the transporter’s listening port. Because Node.js is single-threaded, the hang blocks the entire event loop of the process, taking down every service hosted in it until it is forcibly restarted. TCP transporter endpoints are frequently auto-discovered via UDP broadcast, so any host on the same network segment can reach the port.
Neither the CRC check nor `maxPacketSize` mitigate the issue: the CRC bytes are fully attacker-compu…
Source: GitHub Security Advisories · 2026-11-09