{"id":"EM-20261109-TYJP","url":"https://cyber.eventmonitor.net/incident/EM-20261109-TYJP/moleculer-vulnerability-cve-2026-97705/","type":"cve","title":"Moleculer Vulnerability (CVE-2026-97705)","subtitle":"CVE-2026-97705","subject":"CVE-2026-97705","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-09T22:31:16.000Z","firstSignal":"2026-11-04T20:19:13.137Z","lastSignal":"2026-11-09T22:31:16.000Z","updated":"2026-11-09T23:10:58.551Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T22:31:16.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-09T22:31:16.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T20:19:13.137Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-09T22:31:16.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261109-TYJP created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T20:19:13.137Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T20:19:13.137Z","detail":"CVSS 7.5 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T20:19:13.137Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-97705 (CVSS 7.5)","text":"Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97705"},{"at":"2026-11-09T22:31:16.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-h89v-g948-47vp / CVE-2026-97705: Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser","text":"npm:moleculer, npm:moleculer","url":"https://github.com/advisories/GHSA-h89v-g948-47vp"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T20:19:13.137","score":7.5,"severity":"HIGH","desc":"Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused…","product":"","seen":1793917591435},"kev":null,"epss":{"epss":0.0035,"pct":0.28899,"at":1794265858551},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}