CVE-2026-106447CWE-674

CVE-2026-106447

published October 7, 2026

CVSS
8.7
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-10-07T00:17Z
References (4)
https://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01 · [email protected]https://github.com/StableLib/stablelib/releases/tag/@stablelib/[email protected] · [email protected]https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr · [email protected]https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 19:44Z
    StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags
    cvelistv5