An unauthenticated remote peer can trigger an infinite synchronous loop by supplying a negative packet length.The loop blocks the Node.js event loop and makes every service in that process unresponsive until restart. NVD records CVSS 3.1 at 7.5 High.
What it allows
How Does CVE-2026-97705 Stop a Moleculer Node?
The affected parser reads the packet length as a signed integer. A value with its sign bit set is therefore interpreted as negative.
The parser then slices the packet using that negative length. Node.js clamps the out-of-range start position, so the operation returns the buffer unchanged.
The surrounding loop continues while data remains in that unchanged buffer. Because the loop is synchronous, the Node.js event loop cannot serve other work in the process.
The vulnerable path runs before a protocol handshake or authentication. Exposure requires the Moleculer TCP transporter to be enabled and its listening port to be reachable.
This is a denial-of-service risk, although the advisory describes one remote peer rather than a distributed attack. It also belongs in a broader vulnerability management process.
Who is affected
Moleculer releases earlier than 0.14.36 are affected. The 0.15 branch is affected from 0.15.0-beta1 through releases earlier than 0.15.2.
Versions 0.14.36 and 0.15.2 contain the fix. The patch rejects negative or undersized decoded lengths before the parser enters the non-shrinking loop.
What to do
-
Identify reachable TCP transporters
Inventory Moleculer nodes using the TCP transporter and map which peers can reach each listening port. Prioritize internet-facing and broadly reachable internal deployments.
-
Upgrade each supported branch
Update the 0.14 branch to 0.14.36 or later. Update the 0.15 branch to 0.15.2 or later, then verify the resolved package version.
-
Restrict transporter reachability
Brandefense recommends limiting TCP transporter access to required cluster peers through network policy or host controls. Do not treat this as a substitute for patching.
-
Monitor event-loop availability
Track service health, event-loop responsiveness, and unexpected node restarts. Investigate sudden process-wide stalls on nodes that expose the TCP transporter.
-
Test recovery after deployment
Confirm that each upgraded node rejoins its service topology and handles normal transporter traffic. Review restart procedures for processes hosting multiple critical services.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-97705?
It is a high-severity denial-of-service flaw in the Moleculer TCP transporter. A negative packet length can trap the parser in an infinite synchronous loop.
Which Moleculer versions are affected by CVE-2026-97705?
Versions before 0.14.36 are affected. The 0.15 branch is affected from 0.15.0-beta1 through versions before 0.15.2.
Which Moleculer versions fix CVE-2026-97705?
Moleculer 0.14.36 and 0.15.2 contain the fix. Defenders should install the fixed or a later supported release for their branch.
Does CVE-2026-97705 require authentication?
No. The advisory says the vulnerable path is reachable before a protocol handshake or authentication when the TCP transporter port is accessible.
Is CVE-2026-97705 in CISA KEV?
It was not listed in the CISA Known Exploited Vulnerabilities catalog snapshot released on November 9, 2026.
