CVE-2026-63660

node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7.

• CWE-190
• CWE-787

• https://github.com/mapbox/node-fontnik/pull/202
• https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7
• https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63651LiveDocs is a primary-source-first documentation for AI agen…8.7
• CVE-2026-63652FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-63653Group-Office is an enterprise customer relationship manageme…5
• CVE-2026-63654Frappe is a full-stack web application framework. In version…6.9
• CVE-2026-63655tsParticles is a TypeScript library for creating highly cust…7.5
• CVE-2026-6366Improperly Controlled Modification of Dynamically-Determined…6.6
• CVE-2026-63663CloudBeaver is a cloud database manager. From version 23.2.3…6.5
• CVE-2026-63664CloudBeaver is a cloud database manager. In versions up to a…6.5
• CVE-2026-63667ApostropheCMS is an open-source Node.js content management s…6.5
• CVE-2026-63669ApostropheCMS is an open-source Node.js content management s…6.5
• CVE-2026-6367Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-63670ApostropheCMS is an open-source Node.js content management s…6.1