CVE-2021-41167

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Uncontrolled Resource Consumption pada modern-async project modern-async. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.

Rincian

Terbit di NVD

20 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nicolas-van/modern-async/commit/0010d28de1b15d51db3976080e26357fa7144436 patch · advisory pihak ketiga
• https://github.com/nicolas-van/modern-async/issues/5 exploit · issue tracking · patch · advisory pihak ketiga
• https://github.com/nicolas-van/modern-async/security/advisories/GHSA-3pcq-34w5-p4g2 advisory pihak ketiga