Heap-based Buffer Overflow in sqlite-vec

Description

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.

Recommendation

Update the sqlite-vec package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.3
• Patched version(s): 0.1.3

References

• GHSA-vrcx-gx3g-j3h8
• CVE-2024-46488
• CWE-122
• CWE-787
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Buffer overflow in canvas - CVE-2020-8215
• bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function - CVE-2025-3194
• jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - CVE-2024-28176
• Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

sqlite-vec