CVE-2026-3449
LOW@tootallnate/once < 3.0.1 - Incorrect Control Flow Scoping via AbortSignal Option
Title source: llmDescription
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
References (3)
Core 3
Core References
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612
Issue Tracking
https://github.com/TooTallNate/once/issues/8
Scores
CVSS v3
3.3
EPSS
0.0011
EPSS Percentile
1.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-705
Status
published
Products (4)
None/@tootallnate/once
< 3.0.1
n/a/@tootallnate/once
< 3.0.1
tootallnate/once
0 - 2.0.1npm
tootallnate/once
3.0.0 - 3.0.1npm
Published
Mar 03, 2026
Tracked Since
Mar 03, 2026