GHSA-5jg4-p4qw-cgfr
NoneCVSS
—
EPSS
—
Published
Apr 4, 2026
CISA due date
—
The record
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @stablelib/cbor | 0 | 2.0.3 |
Related vulnerabilities
- GHSA-w48f-fwg7-ww6p @stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding Also affects @stablelib/cbor
- CVE-2026-92822 A flaw was found in libmodulemd. CWE-674
- CVE-2026-112895 Pillow is a Python imaging library. CWE-674
- CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. CWE-674
- CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL… CWE-674
- CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in… CWE-674
- CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in… CWE-674
- CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674