@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags

Description

@stablelib/cbor decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with RangeError: Maximum call stack size exceeded.

Recommendation

Update the @stablelib/cbor package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.3
• Patched version(s): 2.0.3

References

• GHSA-5jg4-p4qw-cgfr
• CWE-674

Related Issues

• Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
• @stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding - Vulnerability
• yaml is vulnerable to Stack Overflow via deeply nested YAML collections - CVE-2026-33532
• Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@stablelib/cbor