CVE-2026-106448

The @stablelib/cbor component within the StableLib library is vulnerable to prototype poisoning (CWE-1321) in versions prior to 2.0.4 . The root cause lies in the CBOR map decoding path, where the library creates ordinary JavaScript objects and uses bracket assignment for attacker-controlled keys...

CVE-2026-106447

The @stablelib/cbor decoder in StableLib (prior to version 2.0.4 ) is vulnerable to a stack exhaustion denial of service . The root cause is that the _decodeValue() function recursively processes nested CBOR arrays, maps, and tags without enforcing a maximum nesting depth. An attacker providing a...