CVE-2026-106447

HighCVSS 8.7

Published: 06/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that does not enforce a maximum nesting depth. A sufficiently deep structure can cause a JavaScript stack overflow, leading to a crash of the process or service.

Risk Assessment

The risk includes denial-of-service (DoS) by sending specially crafted data that can halt the application or process. This could lead to service unavailability.

Recommendation

Upgrade to version 2.0.4, which introduces a nesting depth limit. Additionally, consider adding input validation before processing.

Other vulnerabilities in StableLib

CVE-2026-106448High
The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that allows an attacker to inject a '__proto__' key into a JavaScript object. This overwrites the object's prototype, potentially leading to security decisions based on attacker-controlled data.

Original NVD description (English source)

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS