CVE-2026-3449
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
Reported by snyk · Published March 3, 2026
@tootallnate/once is fixed in 3.0.1 and 2.0.1 (npm)
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then() usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| @tootallnate/once | npm | 3.0.1, 2.0.1 |
| prism | Wolfi | 5.15.11-r0 |
| langfuse-fips-2 | Chainguard | 2.95.12-r31 |
| redisinsight | Chainguard | 3.4.1-r0 |
| opensearch-dashboards-3-fips | Chainguard | 3.6.0-r9 |
| gitlab-rails-ce-fips-18.11 | Chainguard | 18.11.12-r2 |
| vitess-23 | Wolfi | 23.0.4-r8 |
| kibana-9.1 | Chainguard | 9.1.10-r30 |
| kibana-9.4 | Chainguard | 9.4.1-r2 |
| vitess-23 | Chainguard | 23.0.4-r8 |
| opensearch-dashboards-2-fips | Chainguard | 2.19.6-r0 |
| tileserver-gl | Wolfi | 5.5.0-r8 |
44 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | @tootallnate/once | 0 |
| wolfi | prism | 0 |
| chainguard | langfuse-fips-2 | 0 |
| chainguard | redisinsight | 0 |
| chainguard | opensearch-dashboards-3-fips | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| n/a | @tootallnate/once | 0 |
| wolfi | vitess-23 | 0 |
| chainguard | kibana-9.1 | 0 |
| chainguard | kibana-9.4 | 0 |
| chainguard | vitess-23 | 0 |
| chainguard | opensearch-dashboards-2-fips | 0 |
| wolfi | tileserver-gl | 0 |
| wolfi | opensearch-dashboards-3 | 0 |
| chainguard | kibana-9.0 | 0 |
| chainguard | langfuse-fips-3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | prism | 0 |
| wolfi | code-server | 0 |
| wolfi | opensearch-dashboards-2 | 0 |
…and 37 more
Timeline
- Mar 3, 2026 CVE Published
- Mar 3, 2026 EPSS Score (30 in total, the first dated here)
- Mar 3, 2026 PoC Published
- Mar 9, 2026 Security Advisory
- Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
- May 4, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-3449
vulnetix vdb fixes CVE-2026-3449Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-3449/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart