Zurück zur CVE-Übersicht
CVE-2026-3449
LOW(3.3)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Risk Signal Score8/100 — NIEDRIG
EPSS-Score
0%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
3.3
Technische Schwere
Beschreibung
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
GitHub Advisories
GHSA-vpq2-c234-7xj6LOW
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
npm/@tootallnate/once→ 3.0.1
GitHub Advisory