Description (CNA)
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / @tootallnate/once | affected 0 before 3.0.1 |
CWE
CWE-705
References
- https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612
- https://github.com/TooTallNate/once/issues/8
- https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a
ADP enrichment
No English description supplied.
No references supplied.