CVE-2026-3449: @tootallnate/once Package DoS Vulnerability

CVE-2026-3449 Overview

CVE-2026-3449 is an Incorrect Control Flow Scoping vulnerability affecting versions of the @tootallnate/once npm package before 3.0.1. The vulnerability occurs in promise resolving when the AbortSignal option is used. When a signal is aborted, the Promise remains in a permanently pending state, causing any await or .then() usage to hang indefinitely. This behavior can lead to control-flow leaks that result in stalled requests, blocked workers, or degraded application availability.

Critical Impact

Applications using vulnerable versions of @tootallnate/once with AbortSignal can experience indefinite hangs and service degradation when abort signals are triggered, potentially leading to denial of service conditions in Node.js applications.

Affected Products

• @tootallnate/once versions before 3.0.1
• Node.js applications utilizing the vulnerable package with AbortSignal functionality
• Server-side JavaScript applications with abort handling logic

Discovery Timeline

• 2026-03-03 - CVE CVE-2026-3449 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-3449

Vulnerability Analysis

This vulnerability is classified under CWE-705 (Incorrect Control Flow Scoping). The @tootallnate/once package provides utility functions for creating a Promise that resolves the next time a specified event is emitted. When used with the AbortSignal option, the library fails to properly handle the abort scenario.

The core issue lies in how the promise resolution logic interacts with the AbortController API. When an AbortSignal is passed to the once() function and subsequently aborted, the promise should reject with an AbortError. Instead, due to incorrect control flow scoping, the promise neither resolves nor rejects—it remains perpetually pending.

This design flaw affects any code path that awaits the promise or chains .then() handlers, as the execution flow will stall indefinitely waiting for a resolution that never comes.

Root Cause

The root cause is an improper handling of the AbortSignal's abort event within the promise execution context. The library does not properly wire up the abort handler to reject the pending promise, leaving the control flow in an unresolved state. This represents a failure to properly scope the promise's resolve and reject callbacks relative to the abort signal's lifecycle.

Attack Vector

The vulnerability is exploitable locally through application code that uses the affected package. An attacker with the ability to influence abort signal timing—or in scenarios where abort signals are triggered by user actions, timeouts, or external conditions—can cause application threads or event loop iterations to hang indefinitely.

In server-side Node.js applications, this can manifest as:

• HTTP request handlers that never complete
• Worker threads that become permanently blocked
• Cascading failures as resource pools become exhausted with hung operations

The vulnerability mechanism involves the promise's internal state management when handling AbortSignal events. When the signal's abort event fires, the promise should transition to a rejected state with an AbortError. Instead, the promise remains in its initial pending state, causing any code awaiting the promise to block indefinitely. For technical implementation details, see the GitHub commit fix and the related issue discussion.

Detection Methods for CVE-2026-3449

Indicators of Compromise

• Application processes showing unexpectedly high numbers of pending promises
• HTTP requests that timeout on the client side but show as active on the server
• Worker threads or processes that become unresponsive after abort operations
• Memory growth patterns indicating accumulated pending async operations

Detection Strategies

• Scan your project's package.json and package-lock.json for @tootallnate/once dependencies with versions below 3.0.1
• Utilize npm audit or Snyk vulnerability scanning to identify vulnerable package versions in your dependency tree
• Monitor application logs for timeout errors that correlate with AbortSignal usage patterns
• Implement application-level health checks that detect hung promise states

Monitoring Recommendations

• Deploy APM (Application Performance Monitoring) solutions to track promise resolution times and identify abnormal pending durations
• Set up alerts for request handlers exceeding expected completion times, particularly those using abort functionality
• Monitor Node.js event loop lag metrics as an indicator of blocked async operations
• Implement circuit breaker patterns around operations using the affected package

How to Mitigate CVE-2026-3449

Immediate Actions Required

• Update @tootallnate/once to version 3.0.1 or later immediately
• Audit all applications using this package for AbortSignal usage patterns
• Implement timeout wrappers around code using the vulnerable function as a temporary safeguard
• Review downstream dependencies that may include @tootallnate/once transitively

Patch Information

The vulnerability has been addressed in version 3.0.1 of @tootallnate/once. The fix properly handles the AbortSignal abort event to ensure the promise rejects with an appropriate error when the signal is aborted. The patch is available via the GitHub commit. Additional details can be found in the Snyk vulnerability report.

Workarounds

• Wrap calls to the affected function with Promise.race() and a timeout promise to prevent indefinite hangs
• Avoid using the AbortSignal option with vulnerable versions until the update can be applied
• Implement custom abort handling logic that doesn't rely on the vulnerable package's signal processing
• Consider alternative packages that provide similar once-event-to-promise functionality with proper abort handling

# Update @tootallnate/once to the patched version
npm update @tootallnate/once

# Or install the specific fixed version
npm install @tootallnate/once@3.0.1

# Verify the installed version
npm list @tootallnate/once

# Run npm audit to check for additional vulnerabilities
npm audit