Nathan Rajlich

3 exploits Active since Aug 2021
CVE-2021-23406 WRITEUP HIGH WRITEUP
pac-resolver <5.0.0 - Code Injection
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
CVSS 8.1
CVE-2026-3449 WRITEUP LOW WRITEUP
@tootallnate/once < 3.0.1 - Incorrect Control Flow Scoping via AbortSignal Option
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
CVSS 3.3
CVE-2021-23406 WRITEUP HIGH WRITEUP
pac-resolver <5.0.0 - Code Injection
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
CVSS 8.1