Résumé
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
Détails de l’avis
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed.
This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-105757
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
- MEDIUMCVE-2026-59162
Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
- HIGHCVE-2026-84994
Qwik: Crashing any Qwik Server via Resource thenable
- MEDIUMCVE-2026-100347
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
- HIGHCVE-2026-97394
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
- MEDIUMCVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS