Heap-based buffer overflow in node-fontnik (CVE-2026-63660)
The node-fontnik library is vulnerable to a heap out-of-bounds write due to an integer overflow during SDF bitmap allocation, which can lead to process crashes.
CVE search metadata
CVE search record: CVE-2026-63660. Severity: high. CVSS: 8.1. EPSS: 0.41%. KEV: no. Product: node-fontnik < 0.7.7 (< 0.7.7). Brief: Heap-based buffer overflow in node-fontnik (CVE-2026-63660). Brief link: https://feed.craftedsignal.io/briefs/2026-11-node-fontnik-heap-overflow-cve-2026-63660/
Triage facts
Revision 1- Applicability
- node-fontnik < 0.7.7 (< 0.7.7)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
node-fontnik is a library that delivers a range of glyphs rendered as SDFs. A vulnerability exists in the RenderSDF function where the allocation size for the SDF bitmap is computed using a 32-bit unsigned integer. An attacker can provide a crafted font to cause an integer overflow, resulting in an under-allocated heap buffer. This triggers a heap out-of-bounds write during the render loop, which crashes the process.
Impact
Successful exploitation results in process crashes and heap corruption.
Recommendation
Upgrade the node-fontnik library to version 0.7.7 or later.