CVE-2026-3449: @tootallnate/once vulnerable to Incorrect Control Flow Scoping

March 3, 2026 (updated May 21, 2026)

Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.

References

github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a
github.com/TooTallNate/once/issues/8
github.com/TooTallNate/once/releases/tag/v2.0.1
github.com/advisories/GHSA-vpq2-c234-7xj6
nvd.nist.gov/vuln/detail/CVE-2026-3449
security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612

Code Behaviors & Features

Detect and mitigate CVE-2026-3449 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →