@stablelib/cbor: Stack exhaustion denial of service via deeply nested CBOR data

Summary

The @stablelib/cbor npm package decodes CBOR data by processing nested arrays, maps and tags recursively, without a maximum nesting depth, before version 2.0.4. An attacker who can send crafted, deeply nested CBOR data to an application that decodes untrusted input can exhaust the JavaScript call stack. This causes a decoding exception that can terminate the request worker or process, resulting in a denial of service. No authentication is required where the decoder processes untrusted input.

Affected

• @stablelib/cbor (npm) versions before 2.0.4 according to the CVE record
• GitHub advisory GHSA-5jg4-p4qw-cgfr lists versions below 2.0.3; treat 2.0.4 as the minimum safe version

Fixed in

• 2.0.4 (release tag @stablelib/cbor@2.0.4). Sources conflict on 2.0.3, so 2.0.4 is the safe target.

Workaround

• Catch the depth-exceeded error thrown by the decoder so that the process is not terminated (per the GHSA advisory)
• Validate or limit CBOR nesting depth before calling the decoder; the fix adds a default nesting limit of 128, configurable via the maxDepth option
• Restrict endpoints that accept CBOR and enforce request size limits (suggestion, not from a source)

Exploitation

• A public proof of concept exists (reproduction example in the GHSA advisory); CISA SSVC lists exploitation as poc and automatable as yes, with partial technical impact
• No evidence of active exploitation or KEV listing was found in the sources

Our recommendation

• Upgrade @stablelib/cbor to 2.0.4 or later, after verifying the current version
• Check whether your applications use this package directly or via dependencies (for example with npm ls @stablelib/cbor)
• Until patched, apply the workarounds and monitor for unexpected worker or process crashes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-5jg4-p4qw-cgfr github.com
• Fix commit 0149e18 (StableLib) github.com
• Release @stablelib/cbor@2.0.4 (StableLib) github.com
• OSV entry CVE-2026-106447 osv.dev
• OSV entry GHSA-5jg4-p4qw-cgfr osv.dev
• Mend vulnerability database CVE-2026-106447 mend.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:27.