AIKIDO-2026-10697
opentype.js is vulnerable to Denial of Service (DoS)
62
Medium Risk
This Affects:
opentype.jsTL;DR
CFF charstring execution could recurse through subroutine calls without a safe maximum depth, so a crafted outline could exhaust stack space during parsing. TrueType composite glyph loading could follow cyclic component references without detecting revisits, producing unbounded recursion for malformed glyf data. The TrueType hinting virtual machine could execute instruction streams without adequate iteration and call safeguards, allowing non-terminating evaluation on hostile fonts. The update caps subroutine nesting, tracks composite resolution to break cycles, and bounds hinting VM stepping so parsing fails closed instead of hanging or overflowing the stack.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
opentype.js is vulnerable to Denial of Service (DoS) in versions 0.7.0 - 1.3.4.
How to fix this
Upgrade the opentype.js library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant