typelevel fs2 vulnerabilities

Latest typelevel fs2 CVEs

Newest publication first

1. CVE-2025-58369 fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side

   Published 2025-09-05

   Medium·CVSS 5.3

   fs2 is a compositional, streaming I/O library for Scala. Versions up to and including 2.5.12, 3.0.0-M1 through 3.12.2, and 3.13.0-M1 through 3.13.0-M6 are vulnerable to denial of service attacks though TLS sessions using fs2-io on the JVM using the fs2.io.net.tls package. When es...

2. CVE-2022-31183 mTLS client verification is skipped in fs2 on Node.js

   Published 2022-08-01

   Critical·CVSS 9.8

   fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.