# GHSA-g3qj-j598-cxmq: fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

> An unauthenticated attacker can crash the server via a crafted WebAuthn registration request if the native cbor-extract addon is installed.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 24 Mar 2026

## What is GHSA-g3qj-j598-cxmq?

GHSA-g3qj-j598-cxmq is a memory corruption vulnerability in fido2-lib, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary
fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in `extractStrings()` — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.

The crash triggers during WebAuthn registration when the server decodes the attestation object. An attacker sends a crafted authenticator response to the registration endpoint — single request, unauthenticated, instant kill.

Fixed in cbor-extract@2.2.1 / cbor-x@1.6.3 (2026-03-08). fido2-lib@3.5.7 still pins cbor-x ~1.6.0 which resolves to vulnerable cbor-extract.

## Affected versions

fido2-lib <= 3.5.7 (introduced cbor-x dependency). fido2-lib 2.x uses the old `cbor` package — not affected.

Only affects systems where `cbor-extract` native addon is installed (prebuilt binary available for platform). Pure JS fallback is safe.

## PoC

```js
const { decode } = require("cbor-x");
decode(Buffer.from("7a10000000", "hex")); // exit code 139 (SIGSEGV)
```

CBOR text string header claiming 268MB in a 5-byte buffer. `extractStrings()` in extract.cpp line 87 calls `readString()` without bounds check. Reads past buffer into unmapped memory.

In context: attacker intercepts WebAuthn registration response, replaces `attestationObject` with the 5-byte payload, POSTs to the registration verification endpoint. Server calls `attestationResult()` → `cbor-x.decode()` → `cbor-extract` → SIGSEGV.

## Fix

Bump cbor-x to >= 1.6.3 (which pulls cbor-extract >= 2.2.1).

```diff
-"cbor-x": "~1.6.0"
+"cbor-x": "^1.6.3"
```

— Malik X (@Xvush)

## Which versions are affected by GHSA-g3qj-j598-cxmq?

2 open source packages ship an affected version, including fido2-lib.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `fido2-lib` | npm | All versions | 3.5.8 |
| `fido2-lib` | npm | All versions | 3.5.8 |

## How do I fix GHSA-g3qj-j598-cxmq?

Upgrade fido2-lib to 3.5.8 or later.

## Is GHSA-g3qj-j598-cxmq being exploited?

There is no known exploitation of GHSA-g3qj-j598-cxmq in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-g3qj-j598-cxmq and fix it if it is affected.

What it is: GHSA-g3qj-j598-cxmq is a memory corruption vulnerability in fido2-lib, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-g3qj-j598-cxmq in the wild and no public exploit code.

Affected packages and fixed versions:
- fido2-lib (npm): affected all versions; fixed in 3.5.8
- fido2-lib (npm): affected all versions; fixed in 3.5.8

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/ (Markdown: https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-g3qj-j598-cxmq

---
From sbomify Insights: https://insights.sbomify.com/GHSA-g3qj-j598-cxmq/
Summaries are generated and may contain mistakes; the official description above is the record.