GHSA-7vhm-fmph-7wxw

audify vulnerable to Improper Validation of Array Index

Source: GitHub Advisory Database (reviewed) High CVE-2024-21522

Packages

Ecosystem	Package	Affected	Fixed in
npm	audify	<= 1.9.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21522 advisory
https://gist.github.com/dellalibera/6bb866ae5d1cc2adaabe27bbd6d2d21e web
https://github.com/almoghamdani/audify package
https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp#L53 web
https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L79 web
https://security.snyk.io/vuln/SNYK-JS-AUDIFY-6370700 web