GHSA-5jg4-p4qw-cgfr: @stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags

April 4, 2026 (updated April 7, 2026)

@stablelib/cbor decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with RangeError: Maximum call stack size exceeded.

References

github.com/StableLib/stablelib
github.com/StableLib/stablelib/commit/0149e18d9d4736e22c257744ca945ebce7899a01
github.com/StableLib/stablelib/security/advisories/GHSA-5jg4-p4qw-cgfr
github.com/advisories/GHSA-5jg4-p4qw-cgfr

Code Behaviors & Features

Detect and mitigate GHSA-5jg4-p4qw-cgfr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →