Security: DoS via crafted TTF file. Please share security contact

[unshorn]

I've found vulnerabilities in fontkit that allow a small crafted TrueType font to crash a Node.js process when accessing a composite glyph's path. Affects v2.0.4 (current npm release). Do you have a private channel: security email or GitHub Security Advisory to share details and PoC files?

[gflohr]

This is a well-known fact. See https://github.com/gflohr/pdf-lab/blob/main/packages/fontkit/docs/introduction/security.md

Any AI will find countless vulnerabilities in fontkit or its forks. The code was written with the assumption that font program data comes from trusted sources or is pre-checked by hardened tools.