Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

Summary

The TCP transporter's packet parser (src/transporters/tcp/parser.js) reads the packet length field with Buffer.prototype.readInt32BE, a signed read. A crafted packet whose length field has the sign bit set yields a negative length. The parser then advances past the parsed message with packet = packet.slice(length), but Buffer.prototype.slice clamps an out-of-range negative start index to 0, so the buffer is returned unchanged. The while (packet.length > 0) loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely.

Impact

Any Moleculer node using the TCP transporter can be rendered completely unresponsive by an unauthenticated remote peer sending a single ~10-byte crafted TCP packet, before any protocol handshake or authentication takes place. TcpReader.onTcpClientConnected pipes each accepted socket's bytes straight into a fresh Parser instance (socket.pipe(parser)) with no handshake, so the code path is reachable by any peer able to reach the transporter's listening port. Because Node.js is single-threaded, the hang blocks the entire event loop of the process, taking down every service hosted in it until it is forcibly restarted. TCP transporter endpoints are frequently auto-discovered via UDP broadcast, so any host on the same network segment can reach the port.

Neither the CRC check nor maxPacketSize mitigate the issue: the CRC bytes are fully attacker-computable, and maxPacketSize bounds the received buffer size, not the value of the length field.

Affected component

Parser._write in src/transporters/tcp/parser.js.

Patch

The fix validates that the decoded length is at least the 6-byte header size before processing, rejecting negative and undersized values (which would otherwise fail to shrink the buffer) with an error on the write callback instead of looping.

Credit

Reported by xor4xor via the Tidelift security program.