Description

All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.

Remediation

References

https://snyk.io/vuln/SNYK-JS-DISCORDJSOPUS-2403100

https://github.com/discordjs/opus/blob/3ca4341ffdd81cf83cec57045e59e228e6017590/src/node-opus.cc%23L28

Related Vulnerabilities

CVE-2022-24429 Vulnerability in npm package convert-svg-core

CVE-2023-3635 Vulnerability in maven package com.squareup.okio:okio

CVE-2022-25873 Vulnerability in maven package org.webjars.npm:vuetify

CVE-2022-29078 Vulnerability in maven package org.webjars.npm:ejs

CVE-2021-23450 Vulnerability in npm package dojo

Severity

High

Classification

CWE-908 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Third Party Advisory Broken Link