GitHub Advisoryadvisory · npm

GHSA-rvg8-pwq2-xj7q Out-of-bounds Read in base64url

MEDIUM Published 2020-09-01 Modified 2021-09-24 Official page ↗
Ecosystem
npm
Packages
base64url
Severity
Moderate
Weaknesses
CWE-125
Reviewed
2020-08-31

Affected packages

• npm base64url: < 3.0.0 → fixed in 3.0.0

Description

Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. Recommendation Update to version 3.0.0 or later.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References