CVEvulnerability

CVE-2018-7166

7.5 HIGH Published 2018-08-21 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-08-21
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-226, CWE-908

Description

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.

Affected configurations

• nodejs node.js (>= 10.0.0 < 10.9.0)

Related

Weakness · CWE (2)

  • CWE-226 Sensitive Information in Resource Not Removed Before Reuse weakness
  • CWE-908 Use of Uninitialized Resource weakness

References