net-snmp 3.29.0 → 3.29.2

package/README.md

@@ -3808,6 +3808,14 @@ Example programs are included under the module's `example` directory.
 
  * Translate error statuses to their SNMPv1 equivalents when the agent responds to a version 1 request, using the mapping in RFC 2089 section 2.1 - the agent produces statuses from the SNMPv2 set whatever version it is answering, and previously sent codes such as `noAccess` and `notWritable` to SNMPv1 managers unchanged, even though SNMPv1 defines no such values. A SetRequest for a read-only object now returns `noSuchName` to an SNMPv1 manager
 
+# Version 3.29.1 - 13/09/2026
+
+ * Upgrade the Mocha test framework to version 12, clearing the outstanding `serialize-javascript` and `diff` security advisories from the dependency tree - both were development-only transitive dependencies of the test toolchain and were never part of the published package, so no user of the library was exposed. Running the test suite now requires Node.js `^20.19.0 || >=22.12.0`; the library itself is unaffected
+
+# Version 3.29.2 - 09/10/2026
+
+ * Reject a varbind list that ends with a truncated OID instead of looping forever - a short unauthenticated UDP packet whose varbind carried a lone OID tag with no length byte sent the varbind parser into an infinite loop, spinning the CPU at 100% or exhausting memory. Such packets are now rejected with a `ResponseInvalidError` carrying the new `EBadVarbindList` code, closing a network-reachable denial-of-service on agents, receivers, and session clients
+
 # License
 
 Copyright (c) 2020 Mark Abrahams <mark@abrahams.co.nz>

package/index.js

@@ -305,7 +305,8 @@ var ResponseInvalidCode = {
 	11: "EUnexpectedReport",
 	12: "EResponseNotHandled",
 	13: "EUnexpectedResponse",
-	14: "ENotInTimeWindow"
+	14: "ENotInTimeWindow",
+	15: "EBadVarbindList"
 };
 
 _expandConstantObject (ResponseInvalidCode);
@@ -496,6 +497,9 @@ function readVarbindValue (buffer, type) {
 		value = null;
 	} else if (type == ObjectType.OID) {
 		value = buffer.readOID ();
+		if (value == null)
+			throw new ResponseInvalidError ("Truncated OID in varbind list",
+					ResponseInvalidCode.EBadVarbindList);
 	} else if (type == ObjectType.IpAddress) {
 		value = readIpAddress (buffer);
 	} else if (type == ObjectType.Counter) {
@@ -531,10 +535,14 @@ function readVarbinds (buffer, varbinds) {
 	buffer.readSequence ();
 
 	while (1) {
-		buffer.readSequence ();
+		if ( buffer.readSequence () == null )
+			break;
 		if ( buffer.peek () != ObjectType.OID )
 			break;
 		var oid = buffer.readOID ();
+		if (oid == null)
+			throw new ResponseInvalidError ("Truncated OID in varbind list",
+					ResponseInvalidCode.EBadVarbindList);
 		var type = buffer.peek ();
 
 		if (type == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "net-snmp",
-  "version": "3.29.0",
+  "version": "3.29.2",
   "description": "JavaScript implementation of the Simple Network Management Protocol (SNMP)",
   "author": "Mark Abrahams <mark@abrahams.co.nz>",
   "license": "MIT",
@@ -58,6 +58,6 @@
   "devDependencies": {
     "eslint": "^9.9.1",
     "getopts": "^2.3.0",
-    "mocha": "^11.0.1"
+    "mocha": "^12.0.1"
   }
 }