cumulative-distribution-function Infinite Loop vulnerability

Description

A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-function of input data. Although the documentation explains that numeric data is required, some users may confuse an array of strings like [“1”,”2”,”3”,”4”,”5”] for numeric data [1,2,3,4,5] when it is in fact string data.

Recommendation

Update the cumulative-distribution-function package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-58qp-5328-v7mh
• www.npmjs.com
• CVE-2021-29486
• CWE-20
• CWE-835
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• XSS vulnerability allowing arbitrary JavaScript execution - CVE-2021-41174
• Prototype pollution vulnerability in js-extend - CVE-2021-25945
• Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML - CVE-2021-41164
• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

cumulative-distribution-function