Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106447— StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags

Quick assessment

Affected
StableLib stablelib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

StableLib 是一个提供常用 TypeScript 和 JavaScript 代码的稳定库。在 2.0.4 版本之前，@stablelib/cbor 解码器通过 方法递归处理嵌套的 CBOR 数组、映射和标签，但未对最大嵌套深度施加限制。当嵌套结构过深时，会耗尽 JavaScript 调用栈，导致解码异常，并可能终止未捕获的请求工作进程或整个进程。该问题已在 2.0.4 版本中得到修复。

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
StableLib stablelib < 2.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106447

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags
Source: CVE Program / CVE List V5
Vulnerability Description
StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through _decodeValue() without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call stack, causing a decoding exception and potentially terminating an uncaught request worker or process. This issue is fixed in version 2.0.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
StableLib stablelib < 2.0.4 -

II. Public POCs for CVE-2026-106447

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106447

请登录查看更多情报信息。

Other References for CVE-2026-106447 (3)

IV. Related Vulnerabilities

Same product: stablelib
Same vendor: StableLib
Same weakness: CWE-674

V. Comments for CVE-2026-106447

No comments yet

Leave a comment