GitHub Advisoryadvisory · npm

GHSA-mf6x-7mm4-x2g7 Out-of-bounds Read in stringstream

MEDIUM Published 2019-06-20 Modified 2021-03-19 Official page ↗
Aliases
CVE-2018-21270
Ecosystem
npm
Packages
stringstream
Severity
Moderate
Weaknesses
CWE-125
Reviewed
2019-06-20

Affected packages

• npm stringstream: < 0.0.6 → fixed in 0.0.6

Description

All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.

Related

Alias · CVE (1)

  • CVE-2018-21270 Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized… vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References