CVE-2021-29057: 
JavaScript vulnerability analysis and mitigation

A vulnerability was discovered in StaticPool within SUCHMOKUO node-worker-threads-pool version 1.4.3, identified as CVE-2021-29057. The vulnerability was disclosed on March 19, 2021, and affects the thread pool management functionality of the package. This security issue allows attackers to cause a denial of service condition (GitHub Issue).

The vulnerability exists in the timeout mechanism of the StaticPool implementation. When a task is submitted with a malicious infinite loop, the worker thread becomes permanently hijacked until the Node.js process is restarted. The vulnerability has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating network accessibility with low attack complexity (NVD).

The vulnerability can lead to a complete denial of service condition where the thread pool becomes exhausted and unresponsive. When exploited, the affected worker threads are permanently blocked, preventing the execution of subsequent tasks. The system continues to run but becomes effectively non-functional for processing new tasks, and users are not notified of the failure condition (GitHub Issue).