npm/@stablelib/cbor CVE-2026-106447: high 8.7, EPSS 0.47%
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
Action: Upgrade @stablelib/cbor to 2.0.3 or later.
npm i @stablelib/cbor@2.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.3 | - |
Fixed versions
| 2.0.3 |
Sources
- osv: GHSA-5jg4-p4qw-cgfr
- nvd: CVE-2026-106447
- https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr
- https://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01
- https://github.com/StableLib/stablelib
CVE-2026-106447 · published · modified · JSON