GitHub Advisoryadvisory · npm

GHSA-g3qj-j598-cxmq fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

HIGH Published 2026-03-24 Modified 2026-03-24 Official page ↗
Ecosystem
npm
Packages
fido2-lib
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125, CWE-126, CWE-1395
Reviewed
2026-03-24

Affected packages

• npm fido2-lib: < 3.5.8 → fixed in 3.5.8

Description

Summary fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract = 1.6.3 (which pulls cbor-extract >= 2.2.1). ```diff -"cbor-x": "~1.6.0" +"cbor-x": "^1.6.3" ``` — Malik X (@Xvush)

Related

Weakness · CWE (3)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-126 Buffer Over-read weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References