@tootallnate/once vulnerable to Incorrect Control Flow Scoping

Description

Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely.

Recommendation

Update the @tootallnate/once package to the latest compatible version. Followings are version details:

• Affected version(s): **< 2.0.1

  >= 3.0.0, < 3.0.1**

• Patched version(s): **2.0.1

  3.0.1**

References

• GHSA-vpq2-c234-7xj6
• security.snyk.io
• CVE-2026-3449
• CWE-705
• CAPEC-310
• OWASP 2021-A6

Related Issues

• OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding - CVE-2026-30920
• CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
• Backstage vulnerable to potential reading of SCM URLs using built in token - CVE-2026-29185

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@tootallnate/once