SB2026081807 - Incorrect Control Flow Scoping in tootallnate/once

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Control Flow Scoping (CVE-ID: CVE-2026-3449)

CWE-ID: CWE-705 - Incorrect Control Flow Scoping

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. A local user can trigger the vulnerability to cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.

Remediation

Install update from vendor's website.

References

• https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a
• https://github.com/TooTallNate/once/issues/8
• https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612