Versions of @tootallnate/once earlier than 3.0.1 contain a flaw in how the library handles AbortSignal options. When the signal is aborted, the library fails to execute the proper control flow scoping, leaving the returned promise in a permanently pending state. Any code that awaits the promise or attaches a .then() handler will block indefinitely, potentially exhausting resources or halting further application logic. This behavior leads to degraded application availability and can evolve into a denial‑of‑service scenario if exploited in a long‑running or high‑traffic context.

The vulnerability affects the Node.js package @tootallnate/once in all releases prior to version 3.0.1. Users whose code imports this package and passes an AbortSignal option while awaiting the resulting promise are susceptible to the issue.

The CVSS score of 4.8 indicates a moderate severity risk, while the EPSS score of less than 1 % points to a very low probability of exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is through any JavaScript context that calls once with an AbortSignal – for example, server‑side API handlers or client‑side code that manages request cancellation. Successful exploitation would manifest as infinitely pending promises that consume event loop cycles or worker threads, effectively causing a denial of service.