Node Glob
Monthly
AbortSignal cancellation in node-glob 9.0.0 through 14.0.1 does not actually stop a glob walk: when the signal aborts or AbortSignal.timeout() fires, the promise rejects or the stream emits an error, but the walker keeps reading directories in the background. The flaw only matters to applications that pass the 'signal' option to glob() or globStream() as a traversal budget and expose attacker-influenced patterns or attacker-controlled directory trees - repeated timed-out requests then stack filesystem I/O and CPU work, degrading worker throughput and availability. Impact is availability-only and partial (VA:L); the vendor rated it CVSS 4.0 6.3 with AC:L/AT:P, the upstream advisory includes a reproduction proof-of-concept, it is not listed in CISA KEV, and no remote exploit code is known.
AbortSignal cancellation in node-glob 9.0.0 through 14.0.1 does not actually stop a glob walk: when the signal aborts or AbortSignal.timeout() fires, the promise rejects or the stream emits an error, but the walker keeps reading directories in the background. The flaw only matters to applications that pass the 'signal' option to glob() or globStream() as a traversal budget and expose attacker-influenced patterns or attacker-controlled directory trees - repeated timed-out requests then stack filesystem I/O and CPU work, degrading worker throughput and availability. Impact is availability-only and partial (VA:L); the vendor rated it CVSS 4.0 6.3 with AC:L/AT:P, the upstream advisory includes a reproduction proof-of-concept, it is not listed in CISA KEV, and no remote exploit code is known.