StableLib CBOR CVE-2026-106447

Exploitation requires that the target application decode attacker-controlled CBOR input using the @stablelib/cbor decoder in a version prior to the fix (which before 2.0.4/2.0.3 enforced no maximum nesting depth and had no iterative fallback). The concrete trigger is a payload with deeply nested CBOR arrays, maps, or tagged values (the PoC uses depth 12000). The practical limiting factor for impact is error handling: the raised RangeError/decoding exception only escalates to denial of service where the uncaught exception is allowed to terminate the request worker or process - services that wrap decode() in a try/catch degrade to a failed request rather than a crash. No authentication, no user interaction, and no non-default configuration are needed, since the pre-patch default imposed no depth limit.

The CVSS 4.0 base score of 8.7 (HIGH) is driven entirely by availability impact (VA:H) with a clean network-reachable, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/AT:N/PR:N/UI:N); confidentiality and integrity impact are explicitly none (VC:N/VI:N), so this is a pure denial-of-service flaw (CWE-674, uncontrolled recursion). The input Tag 'Information Disclosure' directly contradicts the CVSS impact metrics and the advisory text - this is NOT an information-disclosure issue, and that tag should be disregarded. A working proof-of-concept is embedded in the GHSA advisory (12,000 nested array headers plus a null leaf), so publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation at this time. Real-world risk is sharply conditioned by deployment: the flaw only matters where an application feeds attacker-controlled CBOR into this specific decoder AND an uncaught RangeError is allowed to terminate the worker/process. The headline 8.7 somewhat overstates practical priority for most environments because @stablelib/cbor is a niche library and the impact is a recoverable crash rather than code execution or data loss - treat it as a real but moderate-priority patch, higher for any service that decodes untrusted CBOR on a request path.

An attacker identifies a network service that decodes client-supplied CBOR using @stablelib/cbor (e.g., an API accepting CBOR request bodies) and submits a single small payload consisting of thousands of nested array/map/tag headers terminated by a leaf value. The recursive _decodeValue() descent exhausts the JavaScript call stack, throwing RangeError: Maximum call stack size exceeded; if the host service does not catch the exception, the request worker or process crashes, denying service. A reliable PoC (depth 12000) is published in the GHSA advisory, requiring no authentication or user interaction.