AIKIDO-2026-448660
fast-copy is vulnerable to Uncontrolled Recursion
37
Low Risk
This Affects:
fast-copyTL;DR
fast-copy deep-copies values by recursively traversing nested objects and arrays with no bound on traversal depth. When a deeply nested value is copied, the recursion exhausts the JavaScript call stack and surfaces as a native RangeError that aborts the copy. Applications that copy externally influenced or untrusted data can be driven into this stack exhaustion, producing a denial of service. The fix bounds traversal with a configurable maxDepth option and throws a controlled MaxDepthExceededError before the call stack is exhausted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you copy externally influenced or untrusted deeply nested values.
Background info
fast-copy is vulnerable to Uncontrolled Recursion in versions 0.0.1 - 2.1.7, 3.0.0 - 3.0.2 and 4.0.0 - 4.0.4.
How to fix this
Upgrade the fast-copy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.