{"action":"Upgrade @tootallnate/once to 2.0.1 or later.","affected":[{"fixed":"3.0.1","introduced":"3.0.0"},{"fixed":"2.0.1","introduced":"0"}],"component":"@tootallnate/once","cve_ids":["CVE-2026-3449"],"ecosystem":"npm","epss":0.00165,"exploited":false,"fixed_versions":["3.0.1","2.0.1"],"ghsa_id":"GHSA-vpq2-c234-7xj6","id":"tcs_01M5KGCMBGASQ7C1F2C7GTEYA4","modified_at":"2026-09-10T03:51:00.790088103Z","published_at":"2026-03-03T06:31:14Z","references":["https://osv.dev/vulnerability/GHSA-vpq2-c234-7xj6","https://nvd.nist.gov/vuln/detail/CVE-2026-3449","https://github.com/TooTallNate/once/issues/8","https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a","https://github.com/TooTallNate/once","https://github.com/TooTallNate/once/releases/tag/v2.0.1","https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-vpq2-c234-7xj6","url":"https://osv.dev/vulnerability/GHSA-vpq2-c234-7xj6"}],"summary":"@tootallnate/once vulnerable to Incorrect Control Flow Scoping"}