Incorrect Control Flow Scoping in @tootallnate/once Package

CVE-2026-3449

What is CVE-2026-3449?

The @tootallnate/once package versions prior to 3.0.1 are susceptible to a flaw related to incorrect control flow scoping during promise resolution, specifically when the AbortSignal option is utilized. This vulnerability results in promises getting indefinitely stalled in a pending state after an abort signal is sent, affecting both 'await' and '.then()' calls, and potentially leading to control-flow leaks. As a consequence, impacted applications may experience stalled requests, blocked worker threads, and overall degraded performance.

References