The vulnerability in @tootallnate/once versions prior to 3.0.1 is due to incorrect control flow scoping in promise resolving when the AbortSignal option is used. When the signal is aborted, the Promise does not resolve or reject but remains in a permanently pending state. This causes any asynchronous code awaiting the Promise or chaining with .then() to hang indefinitely, potentially causing stalled requests and blocking worker threads, which degrades application availability. The CVSS 4.8 score reflects a medium severity impact primarily affecting availability with local attack vector and low privileges required.

The vulnerability causes promises to hang indefinitely when aborted via AbortSignal, leading to stalled requests and blocked workers. This results in degraded application availability but does not indicate direct code execution or data compromise. There are no known exploits in the wild. The impact is limited to denial of service conditions affecting the affected application components.

No explicit patch or official fix information is provided in the available data. The vulnerability affects versions before 3.0.1, indicating that upgrading to version 3.0.1 or later may resolve the issue. Users should verify with the package maintainers or official advisories for confirmed remediation. Until then, consider avoiding use of the AbortSignal option with affected versions or implement application-level timeouts to mitigate indefinite hanging.