GitHub Advisoryadvisory · npm

GHSA-w5fc-gj3h-26rx speaker vulnerable to Denial of Service

HIGH Published 2024-07-10 Modified 2024-07-11 Official page ↗
Aliases
CVE-2024-21526
Ecosystem
npm
Packages
speaker
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-241, CWE-400
Reviewed
2024-07-10

Affected packages

• npm speaker: <= 0.5.5 (no fix yet)

Description

All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible to reach an assert macro. Exploiting this vulnerability can lead to a process crash.

Related

Alias · CVE (1)

  • CVE-2024-21526 All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels… vulnerability

Weakness · CWE (2)

  • CWE-241 Improper Handling of Unexpected Data Type weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References