CVE-2021-39131: Ced Project Ced

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.

Affected products

• Ced Project Ced: version 0.1.0 only

Published 2021-08-17. Last modified 2026-06-17.