Skip to content
OpenAdvisories

Package · npm

fido2-lib

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    GHSA-g3qj-j598-cxmq

    fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

    ### Summary fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in `extractStrings()` — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no…

    fido2-lib npm