CVE-2026-3449
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-3449 is a low-severity Incorrect Control Flow Scoping (CWE-705) vulnerability in Snyk (inferred from references). Its CVSS base score is 1.9 (Low).
Operationally, ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9278
Vulnerability Data
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any await or .then()…
more
usage to hang indefinitely. This can cause a control-flow leak that can lead to stalled requests, blocked workers, or degraded application availability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing returns, incorrect exception paths, or failure to restore control flow after unusual conditions.
Security engineering principles can require structured control-flow constructs and explicit state transitions that avoid improper scoping after tasks or errors.
Failing to a known state on indicated failures limits damage from control-flow errors without preventing the underlying scoping mistake.
Fail-safe procedures reduce the consequences of unhandled or mis-scoped control flow on failure but do not correct the scoping defect itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent control-flow scoping errors in code while the control itself encompasses many additional development controls.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect control-flow scoping defects before release.
Secure development lifecycle practices can catch improper control-flow scoping during design and code review.
Secure coding standards directly address correct return and exception handling to prevent control-flow errors.