Description
fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in extractStrings() — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.
Recommendation
Update the fido2-lib package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.5.7
- Patched version(s): 3.5.8
References
Could your website be exposed too?
SmartScanner can check your website for fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
- @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
- @rhinostone/swig: arbitrary local file read via include/extends path traversal - Vulnerability
- @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated March 24, 2026