CVE-2026-63660 · Package
NO FIX YET · SEE WHAT TO DO
node-fontnik renders font glyphs as signed distance fields for map tools. A crafted font with an oversized glyph wraps a 32-bit allocation size, so the render writes past a too-small heap buffer, which can crash the process.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects services that run node-fontnik versions before 0.7.7 and pass it fonts an outside party can supply, such as uploaded font files processed for glyph or tile generation. Systems that only render fonts bundled by the team with trusted inputs are much less exposed. Projects that never install node-fontnik can skip it.
Not affected if fonts-trusted-only, not-installed
Who cares fonts, maps, node, self-hosted
npm ls fontnik in the project.fontnik to see every resolved version, including transitive copies.0.7.7 or later.node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.