Moleculer Releases

Latest: v0.14.36 · 29 Aug 2026 - Security fix(tcp): unauthenticated Denial of Service in the TCP transporter packet parser ( GHSA-h89v-g948-47vp , CWE-835, CVSS 3.1 7.5 High). A crafted packet with a negative length field caused an infinite synchronous loop in Parser._write , blocking the event loop of any node using the TCP transporter — reachable without authentication by a single 10-byte TCP packet. The parser now rejects packets whose length field is smaller than the header size. The 0.15.x line received the same fix in 0.15.2. Changes ci: remove unbuildable native dev dependencies ( @icebob/node-memwatch , gc-stats , event-loop-stats ) and the optional leak-detection suite; replace retired Bitnami Docker images in the E2E test setup Published to npm under the maintenance dist-tag: npm install moleculer@0.14.36