CVE-2024-31206: Jstnmcbrd Dectalk-Tts

High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days.

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.

Affected products

Published 2024-04-04. Last modified 2026-06-17.