CVE-2026-3449: Low severity npm/@tootallnate/once vulnerability
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@tootallnate/onceto a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3449?
The severity of CVE-2026-3449 is considered moderate due to the potential for promise resolution issues.
How do I fix CVE-2026-3449?
To fix CVE-2026-3449, update the @tootallnate/once package to version 3.0.1 or later.
What impact does CVE-2026-3449 have on applications?
CVE-2026-3449 can cause applications to hang indefinitely when using promises with aborted AbortSignal options.
Which versions are affected by CVE-2026-3449?
CVE-2026-3449 affects versions of the @tootallnate/once package prior to 3.0.1.
Is CVE-2026-3449 related to promise handling?
Yes, CVE-2026-3449 specifically involves incorrect control flow in promise resolving when an AbortSignal is used.