by Kastro
Paper/Archive/CVE-2026-27452

CVE-2026-27452

JonathanWilbur asn1-ts — ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer

EPSS 0.3%CVSS 9.2
critical.is priorityof 100
32
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 22.9.229 × 204.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules (BER) and Distinguished Encoding Rules (DER). In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in version 11.0.6.

Affected

ProductAffectedFixed inSource
asn1-ts<= 11.0.5–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/JonathanWilbur/asn1-ts/security/advisories/GHSA-h5rw-vxjr-8q79