CVE-2026-3449

Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a
https://github.com/TooTallNate/once/issues/8
https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612

Configurations

No configuration.

History

29 Apr 2026, 01:00

Type	Values Removed	Values Added
Summary		(es) Versiones del paquete @tootallnate/once anteriores a la 3.0.1 son vulnerables a un Alcance Incorrecto del Flujo de Control en la resolución de promesas cuando se utiliza la opción AbortSignal. La Promesa permanece en un estado permanentemente pendiente después de que la señal es abortada, causando que cualquier uso de await o .then() se quede colgado indefinidamente. Esto puede causar una fuga en el flujo de control que puede llevar a solicitudes estancadas, workers bloqueados o disponibilidad degradada de la aplicación.

03 Mar 2026, 05:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-03 05:17

Updated : 2026-06-17 10:43

NVD link : CVE-2026-3449

Mitre link : CVE-2026-3449

CVE.ORG link : CVE-2026-3449

JSON object : View

Products Affected

No product.

CWE

CWE-705

Incorrect Control Flow Scoping

{"id": "CVE-2026-3449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3449", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T15:31:31.197282Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "report@snyk.io", "affectedData": [{"vendor": "n/a", "product": "@tootallnate/once", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.1", "versionType": "semver"}]}]}], "published": "2026-03-03T05:17:25.017", "references": [{"url": "https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a", "source": "report@snyk.io"}, {"url": "https://github.com/TooTallNate/once/issues/8", "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612", "source": "report@snyk.io"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "report@snyk.io", "description": [{"lang": "en", "value": "CWE-705"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability."}, {"lang": "es", "value": "Versiones del paquete @tootallnate/once anteriores a la 3.0.1 son vulnerables a un Alcance Incorrecto del Flujo de Control en la resoluci\u00f3n de promesas cuando se utiliza la opci\u00f3n AbortSignal. La Promesa permanece en un estado permanentemente pendiente despu\u00e9s de que la se\u00f1al es abortada, causando que cualquier uso de await o .then() se quede colgado indefinidamente. Esto puede causar una fuga en el flujo de control que puede llevar a solicitudes estancadas, workers bloqueados o disponibilidad degradada de la aplicaci\u00f3n."}], "lastModified": "2026-06-17T10:43:36.317", "sourceIdentifier": "report@snyk.io"}