CVE-2026-106447
— UNSCOREDpublic exploit availablePublished 2026-10-06 · Updated 2026-10-07
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.
Weaknesses
CWE-674
Public exploit & PoC references
- https://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01
- https://github.com/StableLib/stablelib/releases/tag/@stablelib/[email protected]
- https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr
- https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr
All references
- https://github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01
- https://github.com/StableLib/stablelib/releases/tag/@stablelib/[email protected]
- https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr
- https://github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100354PoC
- MEDIUMCVE-2026-100702PoC
- MEDIUMCVE-2026-102265PoC
- HIGHCVE-2026-102276PoC
- HIGHCVE-2026-102278PoC
- HIGHCVE-2026-102281PoC
- MEDIUMCVE-2026-102409
- HIGHCVE-2026-102495
Related by shared AI tags and CWE weakness class. Browse the full archive.