CVE-2026-63660

The node-fontnik library (prior to version 0.7.7 ) is vulnerable to a heap out-of-bounds write (CWE-190 → CWE-787) within the RenderSDF function. The root cause is an integer overflow where the product of buffered_width and buffered_height (calculated as a 32-bit unsigned int) exceeds 2³², causin...

PT-2026-144955

node-fontnik is a library that delivers a range of glyphs rendered as SDFs signed distance fields in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF include/mapbox/glyph foundry impl.hpp. RenderSDF computed the SDF bitmap allocation...

CVE-2026-63660: mapbox node-fontnik: node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer

node-fontnik is a library that delivers a range of glyphs rendered as SDFs signed distance fields in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF include/mapbox/glyphfoundryimpl.hpp. RenderSDF computed the SDF bitmap allocation si...