high7.5
CVE-2024-21526
speaker vulnerable to Denial of Service
Impact
All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible to reach an assert macro. Exploiting this vulnerability can lead to a process crash.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | speaker | <= 0.5.5 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/TooTallNate/node-speaker/blob/316afff5a393fce438cf7296011fcfc6e12aa9dc/src/binding.c%23L48
- https://security.snyk.io/vuln/SNYK-JS-SPEAKER-6370676
- https://github.com/advisories/GHSA-w5fc-gj3h-26rx
- https://nvd.nist.gov/vuln/detail/CVE-2024-21526
- https://github.com/TooTallNate/node-speaker/blob/316afff5a393fce438cf7296011fcfc6e12aa9dc/src/binding.c#L48