A vulnerability in the Nest framework’s JsonSocket TCP transport causes handleData() to recurse once per incoming JSON message. When an attacker sends many small, valid JSON messages in a single TCP frame, the recursion depth grows until a RangeError is thrown, resulting in an application crash. This recursive overflow falls under CWE‑674 and leads to a denial‑of‑service impact.

All versions of the Nest framework prior to 11.1.19 are affected. Users running any 11.x release before 11.1.19 should consider themselves vulnerable.

The CVSS score of 7.5 indicates a medium‑to‑high severity. Because no EPSS score is available, the exact likelihood of exploitation is unknown, but the flaw is reachable over an untrusted network via a crafted TCP frame, implying a potential remote DoS. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only the ability to send data to the application’s TCP socket, so authentication is not needed and the attack can be performed from the Internet if the listener is exposed.