Executive brief
@discordjs/opus is a Node.js library used by Discord bot developers to encode audio in the Opus format. Improper error handling in the encoder allows an attacker to crash the entire application when encoding audio with invalid parameters (zero channels or uninitialized buffers), causing service outage until the bot is manually restarted.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-908) in @discordjs/opus versions ≤0.7.0 where improperly handled errors in the audio encoder cause hard crashes instead of returning errors to user code. When encoding is attempted with an encoder configured with zero channels or a non-initialized buffer, the native C++ code throws an unhandled exception that crashes the entire Node.js process. An attacker with network access can trigger this by sending malformed audio data or exploiting application logic that attempts encoding with invalid channel configurations. The attack requires no authentication and is reachable over the network if the affected application exposes audio encoding over a network interface. As of version 0.8.0, error handling was corrected to return errors gracefully instead of crashing.
Affected products
- discord.js opus 0.7.0 and earlier
Timeline
- 2022-06-18: disclosed: Advisory GHSA-rvgf-69j7-xh78 published
- 2022-06-20: patched: Fix released in version 0.8.0