176 matches found
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
Summary Since 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options the change from 5564, fixing 5550. The recursion has no bound and starts each nested call with a fresh state. Two...
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
Summary DsfParser.parseChunks skips an unrecognised chunk's payload with an un-awaited call: js this.tokenizer.ignoreNumberchunkHeader.size - ChunkHeader.len; // lib/dsf/DsfParser.js:51 — no await ChunkHeader.len is 12. A crafted .dsf chunk with id != 'fmt ' and size in 0..11 makes the argument...
GHSA-8J4C-6X6G-RQ3J music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
Summary DsfParser.parseChunks skips an unrecognised chunk's payload with an un-awaited call: js this.tokenizer.ignoreNumberchunkHeader.size - ChunkHeader.len; // lib/dsf/DsfParser.js:51 — no await ChunkHeader.len is 12. A crafted .dsf chunk with id != 'fmt ' and size in 0..11 makes the argument...
CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...
CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...
CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input...
AZL-106845 CVE-2026-107302 affecting package msgpack 3.3.0-1
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...
CVE-2026-107302
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...
GHSA-8F34-F56X-9XPH msgpack5: Truncated map32 headers throw an unexpected error
Impact A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because...
msgpack5: Truncated map32 headers throw an unexpected error
Impact A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because...
CVE-2026-107302 msgpack5: Truncated map32 headers throw an unexpected error
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...
CVE-2026-107302 msgpack5: Truncated map32 headers throw an unexpected error
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...
CVE-2026-107302
The msgpack5 library (a msgpack v5 implementation for Node.js and browsers) contains a vulnerability where the decoder reads a four-byte length of a map32 value before confirming the full five-byte header is present. This leads to a checked out-of-bounds buffer read, causing a RangeError instead ...
PT-2026-108099
Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0 Description The decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header causes a checked out-of-bounds buffer read and...
CVE-2026-107302: Out-of-bounds Read
msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws...
PT-2026-108172
Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.15.0 Description The DSF parser handles unrecognized chunks by calling tokenizer.ignore without awaiting the returned promise and without rejecting chunk sizes smaller than the 12-byte chunk header. A...
GHSA-JGGR-W7FW-PC2J fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
Summary fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library. Details Both copy and copyStrict recurse once per level of...
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
Summary fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library. Details Both copy and copyStrict recurse once per level of...
GHSA-M8VH-JMQ9-5RJG Nest: Remote process termination via a deeply nested microservice message pattern
| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...
Nest: Remote process termination via a deeply nested microservice message pattern
| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/microservices | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary A single message whose pattern is a deeply nested object terminates a NestJS...