{"id":"EUVD-2026-93971","enisaUuid":"a21cc240-8e53-3ef2-b838-0a287fc04689","description":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.","datePublished":"Oct 6, 2026, 7:44:03 PM","dateUpdated":"Oct 7, 2026, 2:40:22 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr\nhttps://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01\nhttps://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4\n","aliases":"CVE-2026-106447\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"2b8267ed-7bea-3d17-82a6-96e8dd252e31","product":{"name":"stablelib","vendor":{"name":"StableLib"}},"product_version":"\u003c 2.0.4"}],"enisaIdVendor":[{"id":"87329aec-f076-33a0-9782-fc8f0117a6af","vendor":{"name":"StableLib"}}],"enisaIdVulnerability":[{"id":"390eea6b-b1fe-3fe1-9803-70db8a3a0028","vulnerability":{"id":"CVE-2026-106447","description":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.","datePublished":"Oct 6, 2026, 7:44:03 PM","dateUpdated":"Oct 7, 2026, 2:40:22 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr\nhttps://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01\nhttps://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4\n","enisa_id":"EUVD-2026-93971\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 1, 2026, 4:04:28 AM","vulnerabilityProduct":[{"id":"1e71749c-c871-3105-bc31-1e1b3ec00c26","product":{"name":"stablelib","vendor":{"name":"StableLib"}},"product_version":"\u003c 2.0.4"}],"vulnerabilityVendor":[{"id":"b8864d82-dd0c-3f3c-a0c2-61ee14e0d6e8","vendor":{"name":"StableLib"}}]}}],"enisaIdAdvisory":[]}