fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
## Summary `fast-copy` traverses values recursively with no bound on depth. Copying a sufficiently deeply-nested value exhausts the JavaScript call stack and throws a native `RangeError: Maximum call stack size exceeded` from inside the library. ## Details Both `copy` and `copyStrict` recurse once per level of nesting. The value does not need to be circular (circular references were already handled correctly via an internal cache) and it does not need to be large. A plain object nested a few thousand levels deep is only a few kilobytes of equivalent JSON. Measured depths at which copying begins to fail (Node.js, V8; the exact ceiling varies with JIT state and the stack available to the environment): | Call | Last depth that copies successfully | | -------------------- | ----------------------------------- | | `copy(object)` | 2811 | | `copy(array)` | 3983 | | `copyStrict(object)` | 1874 | | `copyStrict(array)` | 1874 | `JSON.parse` is iterative and parses deeply-nested input without difficulty, so a payload that deserializes cleanly can fail in a subsequent `copy` call. ## Impact The failure is a synchronous, catchable `RangeError` confined to the `copy` call that received the value. There are no memory safety concerns, no data exposure, and no effect on state outside that call. In a typical server the result is a failed request rather than a failed process. Applications that call `copy` on externally-supplied data, such as request bodies, cached payloads, merged configuratio
GHSA-jggr-w7fw-pc2j
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-jggr-w7fw-pc2j
fast-copy
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 4.1.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
fast-copy
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.1.0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
fast-copy
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.2.0
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.0"
}
]
}
],
"package": {
"name": "fast-copy",
"purl": "pkg:npm/fast-copy",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jggr-w7fw-pc2j/GHSA-jggr-w7fw-pc2j.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
]
}
],
"package": {
"name": "fast-copy",
"purl": "pkg:npm/fast-copy",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jggr-w7fw-pc2j/GHSA-jggr-w7fw-pc2j.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.0"
}
]
}
],
"package": {
"name": "fast-copy",
"purl": "pkg:npm/fast-copy",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jggr-w7fw-pc2j/GHSA-jggr-w7fw-pc2j.json"
}
}
]Publisher severity
medium
Source reference: /severity/0/score
- Event
- #85866 · Revision 1
- Added to Heist Feed
- Publisher date