{"id":"GHSA-vpq2-c234-7xj6","summary":"@tootallnate/once vulnerable to Incorrect Control Flow Scoping","details":"Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.","aliases":["CVE-2026-3449"],"modified":"2026-08-24T00:36:32.392351543Z","published":"2026-03-03T06:31:14Z","database_specific":{"cwe_ids":["CWE-705"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-03-04T20:15:03Z","nvd_published_at":"2026-03-03T05:17:25Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3449"},{"type":"WEB","url":"https://github.com/TooTallNate/once/issues/8"},{"type":"WEB","url":"https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a"},{"type":"PACKAGE","url":"https://github.com/TooTallNate/once"},{"type":"WEB","url":"https://github.com/TooTallNate/once/releases/tag/v2.0.1"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612"}],"affected":[{"package":{"name":"@tootallnate/once","ecosystem":"npm","purl":"pkg:npm/%40tootallnate/once"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vpq2-c234-7xj6/GHSA-vpq2-c234-7xj6.json"}},{"package":{"name":"@tootallnate/once","ecosystem":"npm","purl":"pkg:npm/%40tootallnate/once"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vpq2-c234-7xj6/GHSA-vpq2-c234-7xj6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}