Security Advisory

CVE-2026-3449

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-03-03 05:00:01

Last updated 2026-05-04 05:23:47

Assigner snyk

State PUBLISHED

Description

Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.

← Browse all CVEs View on cve.org ↗