CVE-2026-3449: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3449 is an Incorrect Control Flow Scoping vulnerability in the @tootallnate/once npm package that causes Promises to hang indefinitely when an AbortSignal is used for cancellation. Versions before 2.0.1 and versions ≥3.0.0 before 3.0.1 are affected. The vulnerability was disclosed on February 2, 2026, and published to NVD on March 3, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low) (Red Hat Advisory, Snyk Advisory).

The root cause is classified as CWE-705 (Incorrect Control Flow Scoping) and CWE-1322 (Use of Blocking Code in Single-threaded, Non-blocking Context). In the vulnerable implementation, when an AbortSignal is provided to once() and abort() is called, the internal cleanup() function correctly removes event listeners but never settles the returned Promise — it neither resolves nor rejects it. This leaves the Promise permanently pending, causing any await or .then() chain to hang indefinitely. A proof-of-concept demonstrating the hang was included in the original GitHub issue report and requires only local access with low privileges to trigger (GitHub Issue, Snyk Advisory).

Exploitation results in a control-flow leak that degrades application availability. Affected applications may experience hung await once() calls, stalled HTTP request handlers, blocked worker threads or job queues, and resource exhaustion over time as permanently pending Promises accumulate. There is no impact on confidentiality or integrity; the sole consequence is a low-severity availability degradation that can escalate to application-level denial of service in concurrency-limited environments (GitHub Issue, Red Hat Bugzilla).

A proof-of-concept is publicly available in the original GitHub issue, requiring only a few lines of Node.js code to verify the hang. There is no evidence of in-the-wild exploitation, and the CVE status is marked as "Deferred" by Red Hat. The EPSS score is approximately 0.012% (5th percentile), indicating very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Snyk Advisory, Red Hat Advisory).

1. Identify vulnerable dependency: Confirm the target application uses @tootallnate/once at a version before 2.0.1 or between 3.0.0 and 3.0.1 (exclusive), and that it invokes once() with an AbortSignal option.
2. Trigger AbortSignal: As a local user or through an application interface that exposes cancellation logic, cause AbortController.abort() to be called on the signal passed to once().
3. Observe Promise hang: The returned Promise never settles — any await once(emitter, 'event', { signal }) call in the application hangs indefinitely, blocking the execution path.
4. Exhaust resources: Repeatedly trigger the abort condition to accumulate permanently pending Promises, eventually exhausting worker threads, request handler slots, or event loop capacity, resulting in denial of service (GitHub Issue).

• Application Behavior: HTTP request handlers or worker threads that stop responding without error messages; operations that never time out or complete after an abort signal is triggered.
• Logs: Absence of expected resolution or rejection log entries for operations using once() with AbortSignal; increasing counts of pending async operations in Node.js diagnostics.
• Process: Node.js process showing elevated memory usage or growing event loop lag due to accumulating unresolved Promises; --inspect or diagnostic tooling revealing permanently pending Promise chains tied to @tootallnate/once (GitHub Issue).

Upgrade @tootallnate/once to version 2.0.1 or 3.0.1 (or later), which introduces a dedicated onAbort() handler that rejects the Promise with an AbortError when the signal fires, and also handles the case where the signal is already aborted at call time (GitHub Commit). As a temporary workaround, consumers can wrap once() calls using Promise.race() with a Promise that explicitly rejects on abort, or avoid awaiting once() directly when using AbortSignal. IBM has issued advisories for affected products including Maximo Application Suite, App Connect Enterprise, Data Product Hub, Decision Optimization for Cloud Pak for Data, and IBM Bob (IBM Maximo Advisory, IBM App Connect Advisory).

Red Hat tracked the issue via Bugzilla with medium priority and severity, involving a large CC list of product security engineers across multiple Red Hat product teams (Red Hat Bugzilla). IBM issued multiple security bulletins covering a broad range of affected products. The vulnerability was credited to researcher Nanak Singh Khurana, who disclosed it through a detailed GitHub issue with a clear proof-of-concept and suggested fix (GitHub Issue). Community reaction has been limited given the low severity rating.