CVE-2022-25345: Uncontrolled Resource Consumption in @discordjs/opus

June 18, 2022 (updated June 20, 2022)

All versions of package @discordjs/opus is vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.

References

github.com/advisories/GHSA-rvgf-69j7-xh78
github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L28
nvd.nist.gov/vuln/detail/CVE-2022-25345
snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-2403100

Code Behaviors & Features

Detect and mitigate CVE-2022-25345 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →