CVE-2022-25345: Use of Uninitialized Resource

June 17, 2022 (updated June 28, 2022)

All versions of package @discordjs/opus is vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.

References

github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L28
nvd.nist.gov/vuln/detail/CVE-2022-25345
snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-2403100

Code Behaviors & Features

Detect and mitigate CVE-2022-25345 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →