SUCHMOKUO node-worker-threads-pool denial of service Vulnerability
An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3 that allows attackers to cause a denial of service. This can be mitigated by manually creating a timeout. For example: const { StaticPool } = require("node-worker-threads-pool"); const staticPool = new StaticPool({ size: 1, task: (n) => { while (n) { console.log("a"); } return n; } }); staticPool.createExecutor().setTimeout(10).exec(1).then((result) => { console.log("result from thread pool:", result); }).catch(() => console.error('timeout'));