Executive brief
fido2-lib is a WebAuthn authentication library used by servers to validate registration and authentication credentials from security keys and authenticators. A heap buffer over-read vulnerability in the underlying CBOR parsing library allows an attacker to send a crafted 5-byte response that instantly crashes the Node.js process during credential registration, completely disrupting authentication services without needing any authentication or user interaction.
Technical details
The vulnerability is a heap buffer over-read in cbor-extract (a C++ native addon used by cbor-x for CBOR decoding). The extractStrings() function in extract.cpp line 87 calls readString() without validating that startingPosition + firstStringSize ≤ buffer size; subsequent string reads in the loop are properly bounds-checked, but the first read is not. This allows a crafted CBOR text string header claiming 268MB in a 5-byte buffer to read past allocated heap memory, triggering SIGSEGV and killing the Node.js process with no exception catchable by JavaScript. The attack vector is network-based and unauthenticated: an attacker sends a malicious attestationObject during WebAuthn registration, causing the server's decode() call to crash. The fix requires cbor-x ≥ 1.6.3 and cbor-extract ≥ 2.2.1 (released 2026-03-08); fido2-lib 3.5.7 and earlier pin vulnerable cbor-x ~1.6.0. The pure JavaScript fallback is unaffected; only systems with the native addon installed are vulnerable.
Affected products
- WebAuthn Open Source fido2-lib <= 3.5.7
Timeline
- 2026-03-24: disclosed: GitHub advisory published
- 2026-03-24: patched: fido2-lib 3.5.8 patched (bumps cbor-x to ≥1.6.3)
- 2026-03-08: other: cbor-extract 2.2.1 and cbor-x 1.6.3 with fix released