PT-2026-108638
Published
2026-10-08
·
Updated
2026-10-08
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact
A truncated
map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.Patches
The decoder now validates the complete five-byte
map32 header before reading its length and reports truncated input as IncompleteBufferError.Workarounds
Require at least five bytes before decoding a value beginning with
0xdf, or catch RangeError and treat it as incomplete input only for truncated map32 headers. Found an issue in the description? Have something to add? Feel free to write us 👾