GHSA-vpq2-c234-7xj6
Low · 3.3CVSS
3.3
EPSS
—
Published
Mar 3, 2026
CISA due date
—
The record
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @tootallnate/once | 0 | 2.0.1 |
| npm | @tootallnate/once | 3.0.0 | 3.0.1 |
| Chainguard | code-server | 0 | 4.110.1-r1 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.16.0-r7 |
| Chainguard | librechat | 0 | 0.8.3-r0 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r15 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r6 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r8 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r9 |
| Wolfi | code-server | 0 | 4.110.1-r1 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.16.0-r7 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r15 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r6 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r8 |
Related vulnerabilities
- CVE-2026-3449 Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect… Same vulnerability
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects code-server
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects code-server
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects code-server
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects code-server
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects code-server
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects code-server
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects code-server