npm/fido2-lib: high 7.5
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
Action: Upgrade fido2-lib to 3.5.8 or later.
npm i fido2-lib@3.5.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.5.8 | - |
Fixed versions
| 3.5.8 |
Sources
- osv: GHSA-g3qj-j598-cxmq
- https://github.com/webauthn-open-source/fido2-lib/security/advisories/GHSA-g3qj-j598-cxmq
- https://github.com/kriszyp/cbor-extract/issues/2
- https://github.com/kriszyp/cbor-extract/issues/3
- https://github.com/kriszyp/cbor-extract/commit/1f6e0d9704149bdb5531d25f5d08a0280a71e2ca
- https://github.com/webauthn-open-source/fido2-lib
published · modified · JSON