{"id":"EUVD-2026-9278","enisaUuid":"5669390f-aaa2-3ec9-9411-645f36cd2344","description":"Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.","datePublished":"Mar 3, 2026, 5:00:01 AM","dateUpdated":"May 4, 2026, 5:23:47 AM","baseScore":4.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612\nhttps://github.com/TooTallNate/once/issues/8\nhttps://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a\n","aliases":"CVE-2026-3449\nGHSA-vpq2-c234-7xj6\n","assigner":"snyk","epss":0.13,"enisaIdProduct":[{"id":"38be3291-b54b-3255-ab6e-9e7ef9a99383","product":{"name":"@tootallnate/once","vendor":{"name":"n/a"}},"product_version":"0 \u003c3.0.1"}],"enisaIdVendor":[{"id":"39df9adb-c4f1-3d11-942a-c6cd44c270db","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"34c26ff3-7051-3e05-8ccb-8d0280ba5691","vulnerability":{"id":"GHSA-vpq2-c234-7xj6","description":"@tootallnate/once vulnerable to Incorrect Control Flow Scoping","datePublished":"Mar 3, 2026, 6:31:14 AM","dateUpdated":"May 21, 2026, 4:55:49 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-3449\nhttps://github.com/TooTallNate/once/issues/8\nhttps://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a\nhttps://github.com/TooTallNate/once\nhttps://github.com/TooTallNate/once/releases/tag/v2.0.1\nhttps://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612\n","enisa_id":"EUVD-2026-9278\n","aliases":"GHSA-vpq2-c234-7xj6\nCVE-2026-3449\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:48:04 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6a4824fd-95b1-3b57-b61a-cc3ba48b731e","vulnerability":{"id":"CVE-2026-3449","description":"Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.","datePublished":"Mar 3, 2026, 5:00:01 AM","dateUpdated":"May 4, 2026, 5:23:47 AM","status":"PUBLISHED","baseScore":4.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612\nhttps://github.com/TooTallNate/once/issues/8\nhttps://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a\n","enisa_id":"EUVD-2026-9278\n","assigner":"snyk","epss":0.13,"dataProcessed":"Nov 15, 2026, 7:20:47 AM","vulnerabilityProduct":[{"id":"6143fd90-2c8b-38b0-bd84-05451468c254","product":{"name":"@tootallnate/once","vendor":{"name":"n/a"}},"product_version":"0 \u003c3.0.1"}],"vulnerabilityVendor":[{"id":"eb7e0b6f-f24a-351f-b458-db413c332887","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[{"id":"c825bd90-f62b-35a0-aa1f-4d5957882815","advisory":{"id":"openSUSE-SU-2026:10290-1","description":"heroic-games-launcher-2.20.1-2.1 on GA media","summary":"heroic-games-launcher-2.20.1-2.1 on GA media","datePublished":"Mar 5, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 4:55:47 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10290-1.json\nhttps://www.suse.com/security/cve/CVE-2026-3449/\n","aliases":"CVE-2026-3449\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"10aae2e5-4d5d-3345-ab7f-c3cdddf17a8b","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"37114f60-9842-3caa-8503-c5a30134fc56","product":{"name":"heroic-games-launcher-0:2.20.1-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3b1c4464-5f03-3fef-9f71-9a23cf634138","product":{"name":"heroic-games-launcher-0:2.20.1-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"796ee600-a71d-335c-b267-55341dcdf621","product":{"name":"heroic-games-launcher-2.20.1-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"961d2d0b-9ca1-39d6-b36b-e3adeee0b8f7","product":{"name":"heroic-games-launcher-2.20.1-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9b9fbb87-75e4-3d51-8a9e-09fedc2bdc00","product":{"name":"heroic-games-launcher-2.20.1-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a718705c-06bd-3ac0-b813-49b77b860b20","product":{"name":"heroic-games-launcher-0:2.20.1-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c4cdeab0-15c0-3a24-8ab2-aade6e3a30c4","product":{"name":"heroic-games-launcher-0:2.20.1-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"caad8568-65b2-3c10-89ed-a4675fe095b3","product":{"name":"heroic-games-launcher-2.20.1-2.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"d0b582f9-9e2f-3ef3-b5d6-e391879e5ad4","advisory":{"id":"WID-SEC-W-2026-2118","description":"IBM App Connect Enterprise: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.","datePublished":"Jun 28, 2026, 10:00:00 PM","dateUpdated":"Aug 4, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2118.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-2118\n","aliases":"CVE-2026-3449\nCVE-2026-45149\nCVE-2026-45736\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"4e8514d1-07f3-3816-88c3-c1ef6830c1a2","product":{"name":"App Connect Enterprise","vendor":{"name":"IBM"}}},{"id":"50a42694-555f-36c3-8daa-06d7ce0b52b6","product":{"name":"12.0.12.27","vendor":{"name":"IBM"}}},{"id":"e83b5bdf-06c0-3cbc-b7eb-c698af172bda","product":{"name":"IBM Business Automation Workflow","vendor":{"name":"IBM"}}},{"id":"fe3f2f0b-ada0-35ab-831a-292142494a38","product":{"name":"13.0.8.0","vendor":{"name":"IBM"}}}]}},{"id":"e0ade0a8-89e4-356b-b88c-0b61a094c32d","advisory":{"id":"openSUSE-SU-2026:10429-1","description":"jupyter-jupyterlab-templates-0.5.2-4.1 on GA media","summary":"jupyter-jupyterlab-templates-0.5.2-4.1 on GA media","datePublished":"Mar 25, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 4:58:52 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10429-1.json\nhttps://www.suse.com/security/cve/CVE-2026-3449/\n","aliases":"CVE-2026-3449\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0dca9b10-6572-343e-918e-4090bb74a2df","product":{"name":"jupyter-jupyterlab-templates-0:0.5.2-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"30a00b52-6e88-3def-9ead-b8dc184b9f42","product":{"name":"python311-jupyterlab-templates-0:0.5.2-4.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"32c51a28-41b5-3e5b-ae1c-cfbee9a5e8ff","product":{"name":"python311-jupyterlab-templates-0:0.5.2-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3f9d7c81-de40-3638-a99b-ca4779947bc2","product":{"name":"python311-jupyterlab-templates-0:0.5.2-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4546fd99-a561-3bb9-8002-f7fa69dd638e","product":{"name":"jupyter-jupyterlab-templates-0.5.2-4.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4eaa7b11-87c6-3edf-93c8-c225487d5453","product":{"name":"jupyter-jupyterlab-templates-0:0.5.2-4.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"56883608-1ea5-3df5-aee9-7c3641d0ae05","product":{"name":"python313-jupyterlab-templates-0.5.2-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5defca4f-7ca6-345b-bc0f-b702a258fb7a","product":{"name":"python313-jupyterlab-templates-0:0.5.2-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"69cda202-a250-3099-b87a-5736968c477f","product":{"name":"python311-jupyterlab-templates-0.5.2-4.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"745892e7-2b43-3009-af2e-817cac6ab0de","product":{"name":"jupyter-jupyterlab-templates-0:0.5.2-4.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8066f035-06da-3407-a454-5ce4938d3b6a","product":{"name":"python313-jupyterlab-templates-0.5.2-4.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8c60f87f-32a5-3ff6-b738-4202ea1ab8b4","product":{"name":"python311-jupyterlab-templates-0.5.2-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"926e83be-cf1a-3dd5-9f8a-7acc78fbd00e","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"9c5d8693-b67c-32d1-81db-0772ec030eea","product":{"name":"python313-jupyterlab-templates-0:0.5.2-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a9560dfa-bea8-3a8e-b497-06c81cdabd92","product":{"name":"python311-jupyterlab-templates-0.5.2-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"afd49aed-ae0b-3182-ad3f-4b9bfc4cf33e","product":{"name":"python311-jupyterlab-templates-0:0.5.2-4.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bc9e68be-01be-3b7b-9706-8889c25d0f3d","product":{"name":"python313-jupyterlab-templates-0:0.5.2-4.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bf455c99-ea86-3c96-b7f1-6033e573e1d7","product":{"name":"jupyter-jupyterlab-templates-0.5.2-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d0ee01c5-3a81-386b-aa55-73e94c59dbd4","product":{"name":"python313-jupyterlab-templates-0.5.2-4.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d642a94d-3d3e-3735-8b99-344cf287f48d","product":{"name":"jupyter-jupyterlab-templates-0.5.2-4.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"da7c6c59-6d70-3715-9275-cf17401dd890","product":{"name":"python313-jupyterlab-templates-0.5.2-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"dc1e24d9-6d82-3167-bfb9-fbea05499e97","product":{"name":"jupyter-jupyterlab-templates-0.5.2-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"dfd1f602-60a2-3ee9-ae39-30a685bd2806","product":{"name":"python313-jupyterlab-templates-0:0.5.2-4.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e90f719e-f392-30a3-b019-9f22a2622cb0","product":{"name":"jupyter-jupyterlab-templates-0:0.5.2-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"eb385b2f-f152-3261-82dc-3832027d2ae0","product":{"name":"python311-jupyterlab-templates-0.5.2-4.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}