A single message with a deeply nested object in its pattern can crash a NestJS microservice that uses the TCP or RabbitMQ transport. The attacker‑controlled pattern is passed to JSON.stringify to derive a handler key; when the recursion depth exceeds JavaScript limits a RangeError occurs, and the resulting unhandled promise rejection terminates the Node.js process. The flaw represents uncontrolled recursion and untrusted content deserialization, corresponding to CWE‑674 and CWE‑248, and results in a denial‑of‑service condition.

Applications built with the NestJS framework older than version 11.2.4 or 12.0.2 are affected. The vulnerability exists only when the TCP or RabbitMQ transport is used, because these transports deliver the pattern as a non‑string object; all other NestJS transports are not impacted.

The CVSS score of 7.5 indicates a high impact severity. EPSS data are not available, and the issue is not listed in the CISA KEV catalog. An attacker who can reach the TCP port or publish to the RabbitMQ queue that the microservice consumes can trigger the crash without authentication, making this a readily exploitable denial‑of‑service (DoS) vector.