Stack Exhaustion Vulnerability in fast-copy: Maximum Call Stack Size Exceeded
Summary
GHSA-jggr-w7fw-pc2j: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values. Affects fast-copy across 3 version ranges.
< 2.2.0
>= 3.0.0, < 3.1.0
>= 4.0.0, < 4.1.0
Fixed in 2.2.0, 3.1.0 or 4.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fast-copy is a JavaScript library designed for efficiently copying values, including objects and arrays. It is widely used in applications that require deep cloning of data structures. The library's primary features include handling circular references and providing a straightforward API for copying complex nested values. However, it is susceptible to a stack exhaustion vulnerability when copying deeply-nested values, which can lead to application failures.
Vulnerability Detail
The vulnerability arises from fast-copy's recursive approach to copying values without a limit on nesting depth. When attempting to copy a deeply-nested object or array, the JavaScript call stack can become exhausted, resulting in a native RangeError: Maximum call stack size exceeded. This issue can occur with relatively small payloads that are deeply nested, leading to failed requests in applications that rely on this library for cloning data. The vulnerability is confined to the copy call and does not pose memory safety concerns or data exposure risks.
How To Fix
Latest published version: 4.2.0 as of 22 Oct 2026
npm install fast-copy@4.2.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.02.2.0npm install fast-copy@2.2.0 -
>= 3.0.0, < 3.1.03.1.0npm install fast-copy@3.1.0 -
>= 4.0.0, < 4.1.04.1.0npm install fast-copy@4.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, you can implement a workaround by setting a maximum depth for copying. For example, in versions 3.x and 4.x, you can create a copier with a specified maxDepth as follows: import { createCopier } from 'fast-copy'; export
const copy = createCopier({ maxDepth: 5000 });
In version 2.x, you can pass maxDepth per call: import copy from 'fast-copy';
copy(value, { maxDepth: 5000 });
Conclusion
The stack exhaustion vulnerability in fast-copy poses a risk when copying deeply-nested values, leading to potential application failures. Updating to the latest patched versions or implementing a maxDepth workaround can mitigate this issue. Monitoring tools like Vulert can help ensure your application remains secure against such vulnerabilities.
See every vulnerability recorded for fast-copy →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, it can alert you in real-time. You can also check your application using the Vulert playground without signing up.
If left unaddressed, this vulnerability can lead to application crashes when deeply-nested values are copied, resulting in failed requests and a poor user experience.
No, the vulnerability does not pose any risk of data exposure or memory safety concerns; it only affects the copy operation.
Yes, the maxDepth option is configurable, allowing you to set a higher limit for applications that require it, ensuring safe copying of deeply nested structures.
