Carbone
Monthly
Denial of service in Carbone, a Node.js document generation library, allows remote attackers to crash application servers by supplying a maliciously crafted zip bomb embedded in a .docx template file. The library processed .docx archives (which are ZIP containers) using yazl without enforcing any limit on decompressed entry sizes, enabling an attacker-controlled file to trigger runaway memory allocation that terminates the Node.js process. Fixed in versions 3.8.2, 4.26.3, and 5.4.4 across all distribution types; no public exploit or CISA KEV listing identified at time of analysis.
Denial of service in Carbone, a Node.js document generation library, allows remote attackers to crash application servers by supplying a maliciously crafted zip bomb embedded in a .docx template file. The library processed .docx archives (which are ZIP containers) using yazl without enforcing any limit on decompressed entry sizes, enabling an attacker-controlled file to trigger runaway memory allocation that terminates the Node.js process. Fixed in versions 3.8.2, 4.26.3, and 5.4.4 across all distribution types; no public exploit or CISA KEV listing identified at time of analysis.