Homepage

Out-of-bounds Write Affecting nodejs package, versions <8.11.4-r0

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
1.72% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE320-NODEJS-7010544
  • published23 May 2024
  • disclosed21 Aug 2018
Report a new vulnerability Found a mistake?

Introduced: 21 Aug 2018

CVE-2018-12115  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade Alpine:3.20 nodejs to version 8.11.4-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Alpine. See How to fix? for Alpine:3.20 relevant fixed versions and status.

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names &#39;ucs2&#39;, &#39;ucs-2&#39;, &#39;utf16le&#39; and &#39;utf-16le&#39;), Buffer#write() can be abused to write outside of the bounds of a single Buffer. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.