npmPackage

@stablelib/cbor

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-106448High 8.9
StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding
Affected: fixed in 2.0.3.
Fixed in 2.0.3 (released Apr 2, 2026, 187 days before disclosure).
The latest release, 2.0.5, is not affected.
28% of @stablelib/cbor downloads last week were affected versions (850).
CVE-2026-106447High 8.7
StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags
Affected: fixed in 2.0.3.
Fixed in 2.0.3 (released Apr 2, 2026, 187 days before disclosure).
The latest release, 2.0.5, is not affected.
28% of @stablelib/cbor downloads last week were affected versions (850).