StableLib’s @stablelib/cbor decoder processes nested CBOR arrays, maps, and tags recursively through _decodeValue() without a depth limit. When a deeply nested structure is processed, the JavaScript call stack is exhausted, triggering a decoding exception that can terminate an uncaught request worker or process. The primary impact is a denial of service that can affect the availability of any application that uses the unpatched decoder to parse CBOR data. This flaw is identified as CWE‑674: Uncontrolled Recursion.

The vulnerability affects the StableLib library, specifically versions prior to 2.0.4. Users of stablelib in JavaScript or TypeScript projects that rely on the decoders for CBOR data are at risk until they upgrade to 2.0.4 or later.

With a CVSS score of 8.7 the risk is high. Although an EPSS score is not available, the lack of a public KEV listing does not reduce the potential impact. A malicious CBOR payload with deep nesting can trigger the issue when processed by the decoder. This can be achieved by supplying such a payload from an external source or through any input that the application accepts; elevated privileges are not required. The event is thus likely to be exploitable from any source that supplies input to the decoder.