Description
fast-copy traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native RangeError: Maximum call stack size exceeded from inside the library.
Recommendation
Update the fast-copy package to the latest compatible version. Followings are version details:
Affected version(s): **< 2.2.0 >= 3.0.0, < 3.1.0 >= 4.0.0, < 4.1.0** Patched version(s): **2.2.0 3.1.0 4.1.0**
References
Could your website be exposed too?
SmartScanner can check your website for fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags - Vulnerability
- msgpack5: Deeply nested input can exhaust the decoder stack - CVE-2026-107298
- yaml is vulnerable to Stack Overflow via deeply nested YAML collections - CVE-2026-33532
- OpenCC has an Out-of-bounds read when processing truncated UTF-8 input - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026