CVE-2024-21521: 
JavaScript vulnerability analysis and mitigation

CVE-2024-21521 affects all versions of the package @discordjs/opus, which is a native bindings to libopus. The vulnerability was disclosed on February 20, 2024, and published on July 9, 2024. This security issue has been classified as a Denial of Service (DoS) vulnerability with a CVSS v3.1 base score of 7.5 (High) (Snyk).

The vulnerability is caused by providing an input object with a property toString to several different functions in the package. The affected functions include new OpusEncoder, setBitrate, applyEncoderCTL, and applyDecoderCTL. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Snyk, GitHub POC).

When successfully exploited, this vulnerability can lead to a complete system crash, resulting in a total loss of availability. The attack can be executed remotely without requiring any special privileges or user interaction, making it particularly dangerous for systems using the affected package (Snyk).

The vulnerability has been confirmed to be easily exploitable, with a proof-of-concept (POC) available. The POC demonstrates that the vulnerability can be triggered using multiple attack vectors through different function calls in the package. The exploit has been tested on Ubuntu 22.04.3 LTS with Node v18.19.0 (GitHub POC).

The recommended mitigation is to upgrade @discordjs/opus to version 0.10.0 or higher, which contains the fix for this vulnerability (Snyk).