Medium, CVSS 6.3npmAmendedPublished
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
GHSA-jggr-w7fw-pc2j
- Affected
- npm fast-copy >= 4.0.0, < 4.1.0; >= 3.0.0, < 3.1.0; < 2.2.0
- Fixed in
- 3.1.02.2.04.1.0· Vendor fix available
- Issue
- fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library. Details Both copy and copyStrict recurse once per level of nesting. The value does not need to be circular (circular references were already handled correctly via an internal cache) and it does not need to be large. A plain object nested a few thousand levels deep is only a few kilobytes of equivalent JSON. Measured depths at which copying begins to fail (Node.js, V8; the exact ceiling varies with JIT state and the stack available to the environment): | Call | Last depth that copies successfully | | -------------------- | ----------------------------------- | | copy(object) | 2811 | | copy(array) | 3983 | | copyStrict(object) | 1874 | | copyStrict(array) | 1874 | JSON.parse is iterative and parses deeply-nested input without difficulty, so a payload…
Recommended action: Upgrade to 4.1.0, 3.1.0 or 2.2.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.