{"action":"Upgrade @stablelib/cbor to 2.0.3 or later.","affected":[{"fixed":"2.0.3","introduced":"0"}],"component":"@stablelib/cbor","cve_ids":["CVE-2026-106447"],"ecosystem":"npm","epss":0.00471,"exploited":false,"fixed_versions":["2.0.3"],"ghsa_id":"GHSA-5jg4-p4qw-cgfr","id":"tcs_01M5KF40Q36C7EC258G74TA44S","modified_at":"2026-10-07T10:56:09.289175299Z","published_at":"2026-04-04T05:33:09Z","references":["https://osv.dev/vulnerability/GHSA-5jg4-p4qw-cgfr","https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr","https://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01","https://github.com/StableLib/stablelib"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-5jg4-p4qw-cgfr","url":"https://osv.dev/vulnerability/GHSA-5jg4-p4qw-cgfr"},{"source":"nvd","source_id":"CVE-2026-106447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106447"}],"summary":"@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags"}