TI-2022-09035 Aliases CVE-2022-25345 GHSA-rvgf-69j7-xh78

Denial of service (DoS) in @discordjs/opus

LOW 36CWE-908Published 2022-06-17 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-908 and the CVSS impact.

Summary

All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.

Why it matters now

EPSS 0.01399 72nd percentileScored 2026-11-07

Fix Fixed @discordjs/opus (npm): 0.8.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	@discordjs/opus	all versions	—	No fix listed	CNA
—	@discordjs/opus (npm)	before 0.8.0	0.8.0	Patch available	GHSA-rvgf-69j7-xh78

@discordjs/opus Vendor— Affected all versions Fixed in — No fix listed CNA
@discordjs/opus (npm) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-rvgf-69j7-xh78

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:discordjs:opus::::::node.js::*	all versions	Vulnerable	Discordjs

cpe:2.3:a:discordjs:opus:*:*:*:*:*:node.js:*:* Versions all versions Vulnerable ·Discordjs

Remediation

Fix · GHSA-rvgf-69j7-xh78 @discordjs/opus (npm) Fixed in 0.8.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-25345
2026-10-03 Alias added: GHSA-rvgf-69j7-xh78

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences