Allocation of File Descriptors or Handles Without Limits or Throttling Affecting @sentry/node package, versions >=8.10.0 <8.49.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-SENTRYNODE-8664889
- published29 Jan 2025
- disclosed28 Jan 2025
- creditMichail Strokin
Introduced: 28 Jan 2025
New CVE NOT AVAILABLE CWE-774 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @sentry/node to version 8.49.0 or higher.
Overview
@sentry/node is a Sentry Node SDK using OpenTelemetry for performance instrumentation
Affected versions of this package are vulnerable to Allocation of File Descriptors or Handles Without Limits or Throttling due to the improper management of file handles in the ContextLines integration that is enabled by default. An attacker can cause the application to exhaust system resources by repeatedly triggering the integration to open new file handles without closing previous ones.
Workaround
This vulnerability can be mitigated by disabling the ContextLines integration.