Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
The TCP transporter's packet parser (src/transporters/tcp/parser.js) reads the packet length field with Buffer.prototype.readInt32BE, a signed read. A crafted packet whose length field has the sign bit set yields a negative length. The parser then advances past the parsed message with packet = packet.slice(length), but Buffer.prototype.slice clamps an out-of-range negative start index to 0, so the buffer is returned unchanged. The while (packet.length > 0) loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely.
Recorded fixes — moleculer: 0.15.2 or 0.14.36. Check your release branch.
Exploitation not established
| Affected range | Recorded fix |
|---|---|
| From 0.15.0-beta1 before 0.15.2Semantic versions | 0.15.2 |
Version evidence: OSV · GHSA-h89v-g948-47vp
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0.15.0-beta1"
},
{
"fixed": "0.15.2"
}
],
"type": "SEMVER"
}
],
"versions": []
}| Affected range | Recorded fix |
|---|---|
| Earlier releases before 0.14.36Semantic versions | 0.14.36 |
Version evidence: OSV · GHSA-h89v-g948-47vp
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.36"
}
],
"type": "SEMVER"
}
],
"versions": []
}