CVE-2026-102360

Name of the Vulnerable Software and Affected Versions lib0 versions 0.2.1 through 0.2.117 lib0 versions prior to 1.0.0-rc.33

Description A missing bounds check in the binary decoder allows an unauthenticated remote peer to read adjacent process memory. The readUint8Array() function fails to compare the length supplied over the wire against the decoder's own view. Consequently, providing an over-long length prefix can result in the disclosure of data allocated next by the host process, such as personal data, document content from other tenants, and live bearer session tokens. This occurs when an attacker supplies bytes to a lib0 decoder via an open socket, and the consumer echoes, stores, or re-serves the decoded value.

Recommendations Update to version 0.2.118. Update to version 1.0.0-rc.33.