Executive brief
@discordjs/opus is a Node.js native library providing audio encoding and decoding for voice communication. An attacker can crash the application by passing specially crafted objects with a toString property to encoder initialization or control functions, resulting in service downtime. This vulnerability affects any application using this library for audio processing, potentially disrupting voice features in Discord bots and similar applications.
Technical details
@discordjs/opus is vulnerable to denial of service due to improper input validation in its native C++ binding code. The vulnerability exists in multiple functions (OpusEncoder constructor, setBitrate, applyEncoderCTL, applyDecoderCTL) that fail to validate whether input parameters are of the expected type before passing them to libopus functions. When an attacker provides an object with a toString property instead of a numeric value, the native code attempts to convert the object to a string, which triggers an error in the NAPI layer and causes the Node.js process to crash. The vulnerability is network-reachable if the application exposes these functions via API endpoints or message handlers. No authentication is required; any unauthenticated caller can trigger the crash. Upgrade to version 0.10.0 or higher to resolve this issue.
Affected products
- discordjs @discordjs/opus 0 through 0.9.0
Timeline
- 2024-07-10: disclosed: Public disclosure of CVE-2024-21521
- 2024-07-10: advisory: GHSA-43wq-xrcm-3vgr published