PT-2026-22719 · Unknown · @Tootallnate/Once

Nanak-Singh · Published 2026-03-03 · Updated 2026-05-19 · CVE-2026-3449

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions @tootallnate/once versions prior to 3.0.1

Description The package @tootallnate/once versions prior to 3.0.1 are susceptible to an issue with incorrect control flow scoping in promise resolving when the AbortSignal option is utilized. When the signal is aborted, the Promise remains in a permanently pending state, leading to indefinite hanging of any await or .then() operations. This control-flow leak can potentially result in stalled requests, blocked workers, or reduced application availability.

Recommendations Update @tootallnate/once to version 3.0.1 or later.

Fix

Weakness Enumeration

CWE-705

Related Identifiers

CVE-2026-3449

GHSA-VPQ2-C234-7XJ6

OPENSUSE-SU-2026:10290-1

OPENSUSE-SU-2026:10429-1

Affected Products

@Tootallnate/Once

References · 19

• https://osv.dev/vulnerability/CVE-2026-3449 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10290-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10429-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-3449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3449 · Security Note
• https://osv.dev/vulnerability/GHSA-vpq2-c234-7xj6 · Vendor Advisory
• https://github.com/TooTallNate/once/releases/tag/v2.0.1 · Note
• https://github.com/TooTallNate/once/issues/8 · Note
• https://github.com/TooTallNate/once · Note
• https://github.com/TooTallNate/once/commit/b9f43cc5259bee2952d91ad3cdbd201a82df448a · Note
• https://twitter.com/cyberbivash/status/2028719009995120824 · Twitter Post
• https://t.me/cveNotify/153888 · Telegram Post
• https://t.me/cveNotify/164024 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-TOOTALLNATEONCE-15250612 · Note
• https://twitter.com/CVEnew/status/2028713556070256867 · Twitter Post