Executive brief
The @tootallnate/once library, a utility for handling one-time events in Node.js, contains a flaw that can cause applications to hang indefinitely. When a specific cancellation signal is used, the software may fail to properly clean up its internal state, leading to stalled requests or blocked background tasks. This can result in degraded application performance or a complete loss of availability for certain services.
Technical details
The @tootallnate/once package is vulnerable to Incorrect Control Flow Scoping (CWE-705) in its promise resolution logic. When the AbortSignal option is utilized, an aborted signal may leave the associated Promise in a permanently pending state rather than rejecting or resolving it. This causes any code utilizing 'await' or '.then()' on that promise to hang indefinitely. An attacker with local access could potentially trigger this condition to cause a control-flow leak, leading to stalled requests, blocked worker threads, or a denial-of-service (DoS) condition. The issue is fixed in versions 2.0.1 and 3.0.1.
Affected products
- npm @tootallnate/once >= 3.0.0, < 3.0.1
- npm @tootallnate/once < 2.0.1
Timeline
- 2026-03-03: advisory
- 2026-03-03: disclosed
- 2026-03-04: other: GitHub reviewed the advisory.