{"id":"CVE-2026-63660","kind":"vulnerability","aliases":["CVE-2026-63660"],"related":[],"title":"node-fontnik: crafted font causes heap overflow and process crash","description":"node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.","summary":"node-fontnik renders font glyphs as signed distance fields for map tools. A crafted font with an oversized glyph wraps a 32-bit allocation size, so the render writes past a too-small heap buffer, which can crash the process.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fonts","maps","node","package","self-hosted"],"not_affected_if":["fonts-trusted-only","not-installed"],"how_to_check":"- Check the installed version with `npm ls fontnik` in the project.\n- Search the lockfile for `fontnik` to see every resolved version, including transitive copies.\n- Note whether the service accepts uploaded or user-supplied fonts for glyph rendering.","fix":"- node-fontnik: move to `0.7.7` or later.","status":"open","published_at":"2026-11-11T03:16:52+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:17+00:00","updated_at":"2026-11-11T03:26:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T03:26:17Z","model":"claude-haiku-5-5","output":{"fix":"- node-fontnik: move to `0.7.7` or later.","reach":"unknown","title":"node-fontnik: crafted font causes heap overflow and process crash","impact":"high","summary":"node-fontnik renders font glyphs as signed distance fields for map tools. A crafted font with an oversized glyph wraps a 32-bit allocation size, so the render writes past a too-small heap buffer, which can crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","self-hosted","maps","fonts"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Crafted font crashes the process and corrupts heap memory.","analyst_note":"","how_to_check":"- Check the installed version with `npm ls fontnik` in the project.\n- Search the lockfile for `fontnik` to see every resolved version, including transitive copies.\n- Note whether the service accepts uploaded or user-supplied fonts for glyph rendering.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fonts-trusted-only","not-installed"],"who_is_affected":"Affects services that run node-fontnik versions before 0.7.7 and pass it fonts an outside party can supply, such as uploaded font files processed for glyph or tile generation. Systems that only render fonts bundled by the team with trusted inputs are much less exposed. Projects that never install node-fontnik can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4814,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-190':178C '-2026':13A,16A '-63660':14A,17A '-787':180C '0':204C '0.7.7':92C,212C '2':151C '32':47B,121C '65536':196C,197C '680':186C 'alloc':49B,113C,163C 'bit':48B,122C 'bitmap':112C 'bound':103C,135C,140C 'box':136C 'buffer':61B,88C,116C,118C,158C,198C 'byte':171C,187C 'caus':6A 'comput':109C 'corrupt':174C 'could':96C 'craft':4A,39B,94C 'crash':11A,64B,182C 'cve':12A,15A 'cwe':177C,179C 'deliv':74C 'deriv':128C 'dimens':126C 'distanc':33B,83C 'drive':192C 'enough':145C,190C 'exceed':150C 'field':34B,84C 'font':5A,18B,29B,40B,95C,132C,188C 'fontnik':3A,27B,69C 'freetyp':193C 'glyph':30B,44B,78C,125C,143C,199C 'heap':7A,60B,99C,176C 'height':119C 'host':24B 'include/mapbox/glyph_foundry_impl.hpp':107C 'int':124C 'issu':206C 'larg':144C 'librari':72C 'loop':167C 'make':147C 'map':19B,36B 'node':2A,20B,26B,68C 'node-fontnik':1A,25B,67C 'one':170C 'out-of-bound':100C 'outlin':134C 'overflow':8A 'overs':43B 'packag':21B 'past':55B 'patch':209C 'per':172C 'pixel':173C 'prior':89C 'process':10A,66B,184C 'product':149C 'protocol':87C 'rang':76C 'render':28B,53B,79C,166C 'rendersdf':106C,108C 'sdf':111C 'sdfs':81C 'self':23B 'self-host':22B 'sign':32B,82C 'size':50B,114C,202C 'small':59B,155C 'still':168C 'too-smal':57B 'tool':37B 'trigger':97C 'under-alloc':161C 'unsign':123C 'upload':131C 'upper':139C 'valu':156C 'version':91C,211C 'width':117C 'wrap':45B,152C,200C 'write':54B,104C 'wrote':169C","nicknames":[],"mitigations":[],"who_affected":"Affects services that run node-fontnik versions before 0.7.7 and pass it fonts an outside party can supply, such as uploaded font files processed for glyph or tile generation. Systems that only render fonts bundled by the team with trusted inputs are much less exposed. Projects that never install node-fontnik can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fonts","high","maps","node","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63660':14A,17A 'caus':6A 'craft':4A 'crash':11A 'cve':12A,15A 'font':5A 'fontnik':3A 'heap':7A 'node':2A 'node-fontnik':1A 'overflow':8A 'process':10A","search_b":"'32':47B 'alloc':49B 'bit':48B 'buffer':61B 'craft':39B 'crash':64B 'distanc':33B 'field':34B 'font':18B,29B,40B 'fontnik':27B 'glyph':30B,44B 'heap':60B 'host':24B 'map':19B,36B 'node':20B,26B 'node-fontnik':25B 'overs':43B 'packag':21B 'past':55B 'process':66B 'render':28B,53B 'self':23B 'self-host':22B 'sign':32B 'size':50B 'small':59B 'too-smal':57B 'tool':37B 'wrap':45B 'write':54B","search_c":"'-190':178C '-787':180C '0':204C '0.7.7':92C,212C '2':151C '32':121C '65536':196C,197C '680':186C 'alloc':113C,163C 'bit':122C 'bitmap':112C 'bound':103C,135C,140C 'box':136C 'buffer':88C,116C,118C,158C,198C 'byte':171C,187C 'comput':109C 'corrupt':174C 'could':96C 'craft':94C 'crash':182C 'cwe':177C,179C 'deliv':74C 'deriv':128C 'dimens':126C 'distanc':83C 'drive':192C 'enough':145C,190C 'exceed':150C 'field':84C 'font':95C,132C,188C 'fontnik':69C 'freetyp':193C 'glyph':78C,125C,143C,199C 'heap':99C,176C 'height':119C 'include/mapbox/glyph_foundry_impl.hpp':107C 'int':124C 'issu':206C 'larg':144C 'librari':72C 'loop':167C 'make':147C 'node':68C 'node-fontnik':67C 'one':170C 'out-of-bound':100C 'outlin':134C 'patch':209C 'per':172C 'pixel':173C 'prior':89C 'process':184C 'product':149C 'protocol':87C 'rang':76C 'render':79C,166C 'rendersdf':106C,108C 'sdf':111C 'sdfs':81C 'sign':82C 'size':114C,202C 'small':155C 'still':168C 'trigger':97C 'under-alloc':161C 'unsign':123C 'upload':131C 'upper':139C 'valu':156C 'version':91C,211C 'width':117C 'wrap':152C,200C 'write':104C 'wrote':169C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T11:08:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63660","severity":null,"published_at":"2026-11-11T03:16:52+00:00","modified_at":"2026-11-11T03:16:52+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122066,"url":"https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122067,"url":"https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T11:08:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}