Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
@stablelib/cbor decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with RangeError: Maximum call stack size exceeded. Details The decoder processes arrays, maps, and tagged values through recursive calls. Each nested container causes another descent into decodeValue() until a leaf value is reached. There is no depth limit, no iterative fallback, and no protection against pathological nesting. An attacker can therefore supply a payload made of thousands of nested arrays, maps, or tags and force the decoder to recurse until the JavaScript call stack is exhausted. PoC Impact Any application that decodes attacker-controlled CBOR can be forced into a reliable denial of service with a single crafted payload. The immediate result is an exception during decoding. In services that do not catch that exception safely, the request fails and the worker or process…
Recommended action: Upgrade to 2.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@stablelib/cbor decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named proto therefore changes the prototype of the decoded object instead of becoming an ordinary data property. Details The decoder builds map results with a plain {} and then stores attacker-controlled keys using bracket assignment. That is unsafe for special property names. In JavaScript, assigning to obj["proto"] on a normal object does not create a plain own property. It invokes the built-in proto setter and replaces the object’s prototype if the supplied value is an object or null. As a result, a CBOR payload containing a map entry like: key: "proto" value: { isAdmin: true } does not decode to an object with an own property called proto. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values. PoC Impact Any…
Recommended action: Upgrade to 2.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.