CVE Catalog
CVE-2026-42931
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.38%
31th percentile - higher than 31% of all known CVEs
Summary
The NPM package tag endpoint is vulnerable to DoS via unbounded io.ReadAll, potentially causing excessive memory consumption.
Risk Assessment
An attacker can send malicious requests, exhausting server resources and making the service unavailable to other users.
Recommendation
Limit the size of data read by io.ReadAll, e.g., by setting a request body size limit. Implement DoS protection mechanisms.
Original NVD description (English source)
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint