-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper error handling in native binding functions. The commit diff shows critical additions of 'return env.Null()' after error throws in Encode/Decode methods. In pre-0.8.0 versions, these functions would throw JS exceptions but continue executing C++ code with invalid encoder/decoder states (e.g., zero channels or null buffers), violating CWE-908 (Use of Uninitialized Resource). The unpatched code paths could access invalid memory when trying to encode/decode without proper initialization checks, causing unrecoverable crashes.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @discordjs/opus | npm | < 0.8.0 | 0.8.0 |
Ongoing coverage of React2Shell