cbor-sync: Memory exhaustion via unchecked CBOR array and map lengths
Summary
The Node.js npm package cbor-sync up to version 1.0.4 trusts declared array and map lengths in CBOR.decode without checking them against the remaining input. A remote attacker who can supply CBOR data to an application using the library can send a very small payload that declares huge lengths. Decoding then consumes large amounts of CPU and memory, which can crash the process or cause denial of service.
Affected
- cbor-sync (npm), versions 0 to 1.0.4 (according to the CVE record)
- Vendor status and fixed version: Unknown.
Fixed in
- No fixed release version known.
- OSV lists a fixed git commit 35fdf44ce469ec34b7985f8463c806876fdb8d31, but no release contains it that is confirmed.
Workaround
- No vendor workaround known.
- Do not decode CBOR from untrusted sources without validation.
- Limit input size before decoding.
- Run the decoder with memory and CPU limits or in an isolated process.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Known exploited: no.
- EPSS is low (0.00538).
- Public proof of concept: Unknown.
Our recommendation
- Check lockfiles and dependency trees for cbor-sync, including transitive dependencies.
- If it is used to decode untrusted input, replace it with a maintained CBOR library that validates lengths against the available data.
- Until then, cap input size, apply resource limits and isolate the decoding process.
- Monitor the maintainer repository for a fixed release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- PelionIoT cbor-sync repository github.com
- cbor-sync issue #6 github.com
- cbor-sync pull request #4 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2020-37280 osv.dev
- OpenCVE CVE-2020-37280 app.opencve.io
- Tenable CVE-2020-37280 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:44.
Original description (NVD)
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.