net-snmp 3.29.1 → 3.29.2

package/README.md

@@ -3812,6 +3812,10 @@ Example programs are included under the module's `example` directory.
 
  * Upgrade the Mocha test framework to version 12, clearing the outstanding `serialize-javascript` and `diff` security advisories from the dependency tree - both were development-only transitive dependencies of the test toolchain and were never part of the published package, so no user of the library was exposed. Running the test suite now requires Node.js `^20.19.0 || >=22.12.0`; the library itself is unaffected
 
+# Version 3.29.2 - 09/10/2026
+
+ * Reject a varbind list that ends with a truncated OID instead of looping forever - a short unauthenticated UDP packet whose varbind carried a lone OID tag with no length byte sent the varbind parser into an infinite loop, spinning the CPU at 100% or exhausting memory. Such packets are now rejected with a `ResponseInvalidError` carrying the new `EBadVarbindList` code, closing a network-reachable denial-of-service on agents, receivers, and session clients
+
 # License
 
 Copyright (c) 2020 Mark Abrahams <mark@abrahams.co.nz>

package/index.js

@@ -305,7 +305,8 @@ var ResponseInvalidCode = {
 	11: "EUnexpectedReport",
 	12: "EResponseNotHandled",
 	13: "EUnexpectedResponse",
-	14: "ENotInTimeWindow"
+	14: "ENotInTimeWindow",
+	15: "EBadVarbindList"
 };
 
 _expandConstantObject (ResponseInvalidCode);
@@ -496,6 +497,9 @@ function readVarbindValue (buffer, type) {
 		value = null;
 	} else if (type == ObjectType.OID) {
 		value = buffer.readOID ();
+		if (value == null)
+			throw new ResponseInvalidError ("Truncated OID in varbind list",
+					ResponseInvalidCode.EBadVarbindList);
 	} else if (type == ObjectType.IpAddress) {
 		value = readIpAddress (buffer);
 	} else if (type == ObjectType.Counter) {
@@ -531,10 +535,14 @@ function readVarbinds (buffer, varbinds) {
 	buffer.readSequence ();
 
 	while (1) {
-		buffer.readSequence ();
+		if ( buffer.readSequence () == null )
+			break;
 		if ( buffer.peek () != ObjectType.OID )
 			break;
 		var oid = buffer.readOID ();
+		if (oid == null)
+			throw new ResponseInvalidError ("Truncated OID in varbind list",
+					ResponseInvalidCode.EBadVarbindList);
 		var type = buffer.peek ();
 
 		if (type == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "net-snmp",
-  "version": "3.29.1",
+  "version": "3.29.2",
   "description": "JavaScript implementation of the Simple Network Management Protocol (SNMP)",
   "author": "Mark Abrahams <mark@abrahams.co.nz>",
   "license": "MIT",