Skip to content

[GHSA-vpq2-c234-7xj6] @tootallnate/once vulnerable to Incorrect Control Flow Scoping #7638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
orien wants to merge 1 commit into
base: orien/advisory-improvement-7638
Choose a base branch
from
+37 −7
Open

[GHSA-vpq2-c234-7xj6] @tootallnate/once vulnerable to Incorrect Control Flow Scoping #7638

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 37 additions & 7 deletions advisories/github-reviewed/2026/03/GHSA-vpq2-c234-7xj6/GHSA-vpq2-c234-7xj6.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,11 @@
"CVE-2026-3449"
],
"summary": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
"details": "Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.",
"details": "Affected versions of this package are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
Comment on lines 11 to 15
Copy link
Copy Markdown
Author

@orien orien May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't intend to edit the severity. The form wouldn't submit until I removed the /E:P suffix. I didn't intend for the CVSS_V3 severity to be removed either.

],
"affected": [
Expand All @@ -31,11 +27,33 @@
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@tootallnate/once"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.1"
}
]
}
],
"versions": [
"3.0.0"
]
}
],
Expand All @@ -48,6 +66,10 @@
"type": "WEB",
"url": "https://github.com/TooTallNate/once/issues/8"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/once/commit/a1e5e2d784bcd1c65e49fac1524c6c94fe81f871"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a"
Expand All @@ -56,6 +78,14 @@
"type": "PACKAGE",
"url": "https://github.com/TooTallNate/once"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/once/releases/tag/v2.0.1"
},
{
"type": "WEB",
"url": "https://github.com/TooTallNate/once/releases/tag/v3.0.1"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612"
Expand All @@ -65,7 +95,7 @@
"cwe_ids": [
"CWE-705"
],
"severity": "LOW",
"severity": "MODERATE",
Comment on lines -68 to +98
Copy link
Copy Markdown
Author

@orien orien May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't intend to change the severity. Although the sync page does report medium: https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612

Image

"github_reviewed": true,
"github_reviewed_at": "2026-03-04T20:15:03Z",
"nvd_published_at": "2026-03-03T05:17:25Z"
Expand Down
Loading