CVE-2026-106447

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106447

EUVD

EUVD-2026-93971

Affected Vendors & Products

Vendor	Product	Version / Range
StableLib	stablelib	< 2.0.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is in StableLib, a TypeScript/JavaScript library. The @stablelib/cbor decoder before version 2.0.4 does not limit how deeply nested CBOR arrays, maps, or tags can be processed. This allows a deeply nested structure to exhaust the JavaScript call stack, causing a decoding exception that may crash a request worker or process.

Detection Guidance

This vulnerability can be detected by checking the version of StableLib in use. If your system uses a version prior to 2.0.4, it is vulnerable. No specific commands are provided in the context to detect this vulnerability.

Impact Analysis

If you use the vulnerable version of StableLib, an attacker could send maliciously crafted CBOR data to trigger a stack overflow. This could crash your application or service, leading to denial of service or unexpected termination of processes handling requests.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by causing denial-of-service conditions in systems processing CBOR data. Uncaught exceptions from stack exhaustion might lead to service disruptions, which could affect availability requirements under these regulations.

Mitigation Strategies

Immediately upgrade StableLib to version 2.0.4 or later to address the vulnerability. Avoid processing untrusted CBOR data until the upgrade is complete.

Hi! I’m here to help you understand CVE-2026-106447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70