Buffer Overflow in Nestjs with Hmac Signatures

A buffer overflow in a NestJS application that uses Hmac signatures typically arises when input validation is limited to signature validity while allowing unchecked data into fixed-size buffers downstream. The Hmac signature itself is a cryptographic string; verifying it does not constrain the size or structure of the request payload, headers, or parsed objects. If the application deserializes or copies incoming JSON, multipart, or raw body content into buffers or fixed-length structures without enforcing length limits, an attacker can supply oversized payloads that exceed allocated memory regions.

In NestJS, common patterns such as class-validator pipes, file uploads via multipart packages, or manual buffer handling in controllers can expose this risk. For example, a route accepting JSON might parse the body into a JavaScript object, but if the runtime or underlying libraries allocate fixed-size buffers for processing, an attacker can send a deeply nested or extremely large payload that triggers a classic buffer overflow in native addons or C++ extensions (e.g., certain image or crypto bindings). Even when the Hmac signature confirms integrity and authenticity, the unchecked payload continues through the runtime, potentially corrupting memory if native modules are involved.

Another vector involves log or audit trails where the request metadata and the Hmac signature are stored in fixed-size database columns or in-memory buffers. An attacker can exploit oversized signature values or injected content to overflow these buffers, leading to information leakage or code execution. Because the Hmac verification succeeds, the request is treated as trusted, amplifying the impact of any overflow that occurs after verification.

The interplay of Hmac signatures and buffer overflow also surfaces in SSRF-related concerns: an attacker can cause the server to make outbound requests to endpoints that return large or malicious payloads. If the application buffers these responses without size checks, overflow conditions can arise even though the original inbound Hmac was valid. This means the security control (Hmac verification) does not mitigate a flaw in how the application consumes external data.

Real-world examples align with OWASP API Top 10 categories such as Excessive Data Exposure and Improper Input Validation. Known CVEs affecting native modules or language runtimes illustrate how a single unchecked payload can compromise an otherwise correctly verified Hmac flow. The key takeaway is that cryptographic integrity checks and memory safety are orthogonal; verifying a Hmac signature does not prevent buffer overflows caused by unchecked data handling.

Remediation focuses on strict input validation, payload size limits, and safe handling before and after Hmac verification. Apply limits at the framework and transport layers, and ensure downstream consumers never process unbounded data.

Example 1: Validating and limiting payload size before Hmac verification

import { Controller, Post, Body, Req, UseInterceptors } from '@nestjs/common';
import { ApiBody, ApiOperation } from '@nestjs/swagger';
import { RawBodyInterceptor } from './raw-body.interceptor';

@Controller('orders')
export class OrdersController {
  // Limit raw body to 10 KB before any processing
  @UseInterceptors(RawBodyInterceptor)
  @Post('create')
  @ApiOperation({ summary: 'Create order with Hmac signature' })
  @ApiBody({ type: Object })
  create(
    @Req() req,
    @Body() dto: any,
  ) {
    const provided = req.headers['x-hmac'];
    if (!provided) throw new Error('Missing Hmac');
    // Verify Hmac over raw body (implementation omitted)
    const isValid = verifyHmac(provided, req.rawBody, process.env.SECRET);
    if (!isValid) throw new Error('Invalid Hmac');
    // Safe to process dto here; size already constrained
    return { ok: true };
  }
}

// raw-body.interceptor.ts
import { createParamDecorator, ExecutionContext, Injectable } from '@nestjs/common';
import { readFileSync } from 'fs';

@Injectable()
export class RawBodyInterceptor {
  transform(req, next) {
    const limit = 10 * 1024;
    const chunks = [];
    let total = 0;
    return new Promise((resolve, reject) => {
      req.on('data', (chunk) => {
        total += chunk.length;
        if (total > limit) {
          reject(new Error('Payload too large'));
          return;
        }
        chunks.push(chunk);
      });
      req.on('end', () => {
        req.rawBody = Buffer.concat(chunks);
        req.body = JSON.parse(req.rawBody.toString());
        resolve(next());
      });
      req.on('error', reject);
    });
  }
}

Example 2: Safe Hmac generation and constant-time comparison

import { createHmac } from 'crypto';

export function generateHmac(secret: string, payload: string | Buffer): string {
  return createHmac('sha256', secret).update(payload).digest('hex');
}

export function verifyHmac(expected: string, payload: string | Buffer, secret: string): boolean {
  const actual = createHmac('sha256', secret).update(payload).digest('hex');
  return timingSafeEqual(expected, actual);
}

function timingSafeEqual(a: string, b: string): boolean {
  if (a.length !== b.length) return false;
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

Example 3: Validating object size and structure after parsing

import { Controller, Post, Body, ValidationPipe } from '@nestjs/common';
import { MaxBodySizePipe } from './max-body-size.pipe';

@Controller('users')
export class UsersController {
  @Post('profile')
  create(
    @Body(new ValidationPipe({ transform: true, whitelist: true })) 
    dto: CreateUserDto,
  ) {
    return { ok: true };
  }
}

// max-body-size.pipe.ts
import { PipeTransform, ArgumentMetadata, BadRequestException } from '@nestjs/common';

export class MaxBodySizePipe implements PipeTransform {
  transform(value: any, metadata: ArgumentMetadata) {
    const json = JSON.stringify(value);
    const size = Buffer.byteLength(json, 'utf8');
    const max = 5 * 1024; // 5 KB
    if (size > max) throw new BadRequestException('Request body too large');
    return value;
  }
}

Operational and architectural mitigations

• Set framework-level limits for JSON and raw bodies (e.g., payload size caps).
• Apply size checks before Hmac verification when possible to avoid processing maliciously large inputs even with valid signatures.
• Use streaming parsers for large uploads and enforce chunk size limits.
• Audit native addons and dependencies for unsafe buffer operations; prefer maintained, memory-safe libraries.
• Log and monitor for unusually large payloads even when Hmac verification passes, as this may indicate probing or exploit attempts.