CVE-2026-97705: Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

### Summary The TCP transporter's packet parser (`src/transporters/tcp/parser.js`) reads the packet length field with `Buffer.prototype.readInt32BE`, a signed read. A crafted packet whose length field has the sign bit set yields a negative `length`. The parser then advances past the parsed message with `packet = packet.slice(length)`, but `Buffer.prototype.slice` clamps an out-of-range negative start index to `0`, so the buffer is returned unchanged. The `while (packet.length > 0)` loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely. ### Impact Any Moleculer node using the TCP transporter can be rendered completely unresponsive by an unauthenticated remote peer sending a single ~10-byte crafted TCP packet, before any protocol handshake or authentication takes place. `TcpReader.onTcpClientConnected` pipes each accepted socket's bytes straight into a fresh `Parser` instance (`socket.pipe(parser)`) with no handshake, so the code path is reachable by any peer able to reach the transporter's listening port. Because Node.js is single-threaded, the hang blocks the entire event loop of the process, taking down every service hosted in it until it is forcibly restarted. TCP transporter endpoints are frequently auto-discovered via UDP broadcast, so any host on the same network segment can reach the port. Neither the CRC check nor `maxPacketSize` mitigate the issue: the CRC bytes are fully attacker-computable, and `maxPacketSize` bounds the received buffer size, not the value of the length field. ### Affected component `Parser._write` in `src/transporters/tcp/parser.js`. ### Patch The fix validates that the decoded length is at least the 6-byte header size before processing, rejecting negative and undersized values (which would otherwise fail to shrink the buffer) with an error on the write callback instead of looping. ### Credit Reported by xor4xor via the Tidelift security program.