CVE-2026-30909 is an integer overflow (CVSS 9.8) in Perl module Crypt::NaCl::Sodium versions through 2.002. Several functions do not check output size, so a huge input could produce an undersized buffer. The record calls this unlikely in practice. Upgrade past 2.002.
What's affected
Crypt::NaCl::Sodium versions through 2.002 for Perl are affected. The affected functions are bin2hex, encrypt, aes256gcm_encrypt_afternm and seal.
The references include a patch and the 2.003 change log on MetaCPAN. Confirm the fixed release on MetaCPAN before you rely on it.
How to check if you're exposed
Print the installed module version:
perl -MCrypt::NaCl::Sodium -e 'print $Crypt::NaCl::Sodium::VERSION, qq{\n}'
Search your Perl projects for calls to the four affected functions and note how large an input they can receive. Also check any cpanfile or Makefile.PL that pins the module.
What to do now
- Upgrade Crypt::NaCl::Sodium to a release after 2.002, and confirm the exact version in the MetaCPAN change log.
- Cap message and input lengths in your own code before they reach the library.
- Rebuild and redeploy applications that bundle the module.
- Add the module to your dependency inventory so future advisories are caught.
Why it matters
The weakness class is CWE-190, integer overflow or wraparound. The code computes an output size without checking that the result stays below SIZE_MAX. If it wraps, the buffer is allocated too small.
The record is clear that this is unlikely to be hit, because the input would need to be enormous. For bin2hex the length would need to exceed SIZE_MAX divided by 2, and for encrypt and aes256gcm_encrypt_afternm the message would need to exceed SIZE_MAX minus 16. A critical score here reflects what could happen, not how easy it is. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should I panic about a 9.8 here?
No. The record itself says encountering the issue is unlikely. Plan the upgrade as routine work and limit input sizes.
Sources
Last reviewed: 19 October 2026.
