CVE-2026-97705
Description
A flaw was found in Moleculer. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by sending a malformed network packet with a negative length value to an exposed TCP (Transmission Control Protocol) transporter. This input triggers an infinite loop that blocks the application event loop, rendering all services in the process completely unresponsive until restarted.
Statement
This vulnerability is rated as having an Important severity because an unauthenticated remote attacker can completely deny service to the application process without requiring privileges or user interaction. By transmitting a specially crafted packet to a node configured with the TCP transporter, the parsing loop permanently starves the single-threaded Node.js event loop, halting all hosted services until the daemon is manually restarted. Risk is reduced in environments that do not configure the optional TCP transporter or where microservice communication channels are strictly segregated from untrusted networks.
Mitigation
Restrict network exposure of the Moleculer TCP transporter port to trusted cluster nodes using firewall rules, or reconfigure the application to use an alternative supported transporter mechanism (such as Redis or NATS).
To limit access using firewalld on Red Hat Enterprise Linux:
1. Remove general access to the custom transporter port (for example, TCP port 12345):
firewall-cmd --permanent --remove-port=12345/tcp
2. Allow access to the port only from trusted peer IP addresses or subnets:
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_SUBNET>
3. Apply the firewall configuration:
firewall-cmd --reload
Caveats: Network filtering requires maintaining an allowlist of all valid cluster member addresses. Blocking legitimate inter-node communication will prevent microservices from discovering or communicating with each other.
Warning: Reloading firewall rules may briefly disrupt active network sessions. Applying transporter configuration changes requires restarting the affected Node.js service, leading to temporary service unavailability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
