GHSA-w5fc-gj3h-26rx

speaker vulnerable to Denial of Service

Source: GitHub Advisory Database (reviewed) High CVE-2024-21526

Packages

Ecosystem	Package	Affected	Fixed in
npm	speaker	<= 0.5.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property of the Speaker object makes it possible to reach an assert macro. Exploiting this vulnerability can lead to a process crash.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21526 advisory
https://github.com/TooTallNate/node-speaker package
https://github.com/TooTallNate/node-speaker/blob/316afff5a393fce438cf7296011fcfc6e12aa9dc/src/binding.c#L48 web
https://security.snyk.io/vuln/SNYK-JS-SPEAKER-6370676 web