{"id":"CVE-2021-29057","aliases":["EUVD-2023-2238","GHSA-7vxc-q7rv-qfj8"],"status":"published","title":"SUCHMOKUO node-worker-threads-pool denial of service Vulnerability","description":"An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00586,"percentile":0.48475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400","CWE-770"],"published":"2023-08-11T00:00:00Z","modified":"2026-06-17T03:47:12Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"node-worker-threads-pool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.3"}]}]},{"source":"osv","ecosystem":"npm","package":"node-worker-threads-pool","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.4.3"}]}]}],"products":[{"vendor":"thoughtworks","product":"node-worker-threads-pool"}],"references":[{"url":"https://github.com/SUCHMOKUO/node-worker-threads-pool/issues/20","tags":["x_transferred","Exploit","Issue Tracking","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29057","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7vxc-q7rv-qfj8"},{"url":"https://github.com/SUCHMOKUO/node-worker-threads-pool","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-29057","description":"An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.","status":"published","published":"2023-08-11T00:00:00Z","modified":"2024-10-09T18:37:53.13Z","updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2023-2238","description":"An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.","status":"published","published":"2023-08-11T00:00:00Z","modified":"2024-10-09T18:37:53Z","updated_at":"2026-11-03T00:27:42.985312Z"}],"ghsa":[{"id":"GHSA-7vxc-q7rv-qfj8","title":"SUCHMOKUO node-worker-threads-pool denial of service Vulnerability","description":"An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service.\n\nThis can be mitigated by manually creating a timeout. For example:\n\n```ts\nconst { StaticPool } = require(\\\"node-worker-threads-pool\\\");\n\t\n\tconst staticPool = new StaticPool({\n size: 1,\n task: (n) =\u003e {\n while (n) {\n console.log(\\\"a\\\");\n }\n return n;\n }\n});\n \n staticPool.createExecutor().setTimeout(10).exec(1).then((result) =\u003e {\n console.log(\\\"result from thread pool:\\\", result);\n}).catch(() =\u003e console.error('timeout'));\n```","status":"published","published":"2023-08-11T15:30:46Z","modified":"2024-10-03T17:26:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:38:07.852618Z"}],"nvd":[{"id":"CVE-2021-29057","description":"An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.","status":"published","published":"2023-08-11T14:15:12.813Z","modified":"2026-06-17T03:47:12.857Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"GHSA-7vxc-q7rv-qfj8","title":"SUCHMOKUO node-worker-threads-pool denial of service Vulnerability","description":"An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service.\n\nThis can be mitigated by manually creating a timeout. For example:\n\n```ts\nconst { StaticPool } = require(\\\"node-worker-threads-pool\\\");\n\t\n\tconst staticPool = new StaticPool({\n size: 1,\n task: (n) =\u003e {\n while (n) {\n console.log(\\\"a\\\");\n }\n return n;\n }\n});\n \n staticPool.createExecutor().setTimeout(10).exec(1).then((result) =\u003e {\n console.log(\\\"result from thread pool:\\\", result);\n}).catch(() =\u003e console.error('timeout'));\n```","status":"published","published":"2023-08-11T15:30:46Z","modified":"2024-10-03T17:26:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:41.349637Z"}]}}