{"answers":{"affected":"2 open source packages ship an affected version, including fido2-lib.","exploited":"There is no known exploitation of GHSA-g3qj-j598-cxmq in the wild and no public exploit code.","fix":"Upgrade fido2-lib to 3.5.8 or later.","what":"GHSA-g3qj-j598-cxmq is a memory corruption vulnerability in fido2-lib, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-g3qj-j598-cxmq and fix it if it is affected.\n\nWhat it is: GHSA-g3qj-j598-cxmq is a memory corruption vulnerability in fido2-lib, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-g3qj-j598-cxmq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- fido2-lib (npm): affected all versions; fixed in 3.5.8\n- fido2-lib (npm): affected all versions; fixed in 3.5.8\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/ (Markdown: https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/index.md)","id":"GHSA-g3qj-j598-cxmq","markdown":"https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/index.md","name":"GHSA-g3qj-j598-cxmq","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Node.js WebAuthn library","requires_auth":"none","summary":"An unauthenticated attacker can crash the server via a crafted WebAuthn registration request if the native cbor-extract addon is installed.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nfido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract \u003c= 2.2.0 has a heap buffer over-read in `extractStrings()` — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.\n\nThe crash triggers during WebAuthn registration when the server decodes the attestation object. An attacker sends a crafted authenticator response to the registration endpoint — single request, unauthenticated, instant kill.\n\nFixed in cbor-extract@2.2.1 / cbor-x@1.6.3 (2026-03-08). fido2-lib@3.5.7 still pins cbor-x ~1.6.0 which resolves to vulnerable cbor-extract.\n\n## Affected versions\n\nfido2-lib \u003c= 3.5.7 (introduced cbor-x dependency). fido2-lib 2.x uses the old `cbor` package — not affected.\n\nOnly affects systems where `cbor-extract` native addon is installed (prebuilt binary available for platform). Pure JS fallback is safe.\n\n## PoC\n\n```js\nconst { decode } = require(\"cbor-x\");\ndecode(Buffer.from(\"7a10000000\", \"hex\")); // exit code 139 (SIGSEGV)\n```\n\nCBOR text string header claiming 268MB in a 5-byte buffer. `extractStrings()` in extract.cpp line 87 calls `readString()` without bounds check. Reads past buffer into unmapped memory.\n\nIn context: attacker intercepts WebAuthn registration response, replaces `attestationObject` with the 5-byte payload, POSTs to the registration verification endpoint. Server calls `attestationResult()` → `cbor-x.decode()` → `cbor-extract` → SIGSEGV.\n\n## Fix\n\nBump cbor-x to \u003e= 1.6.3 (which pulls cbor-extract \u003e= 2.2.1).\n\n```diff\n-\"cbor-x\": \"~1.6.0\"\n+\"cbor-x\": \"^1.6.3\"\n```\n\n— Malik X (@Xvush)","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing","id":"GHSA-g3qj-j598-cxmq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["3.5.8"],"introduced":["0"],"last_affected":[],"package":"fido2-lib","purl":null,"source":"GHSA-g3qj-j598-cxmq"},{"ecosystem":"npm","fixed":["3.5.8"],"introduced":["0"],"last_affected":[],"package":"fido2-lib","purl":"pkg:npm/fido2-lib","source":"GHSA-g3qj-j598-cxmq"}],"products":null,"published":"2026-03-24","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An unauthenticated attacker can crash the server via a crafted WebAuthn registration request if the native cbor-extract addon is installed.","url":"https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/"}