Out-of-bounds Read Affecting libxmljs package, versions >=0.8.0 <1.0.0


Severity

Recommended
0.0
high
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.37% (58th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JS-LIBXMLJS-10557424
  • published27 Jun 2025
  • disclosed18 May 2017
  • creditUnknown

Introduced: 18 May 2017

CVE-2017-9049  (opens in a new tab)
CWE-125  (opens in a new tab)

How to fix?

Upgrade libxmljs to version 1.0.0 or higher.

Overview

libxmljs is a libxml bindings for v8 javascript engine

Affected versions of this package are vulnerable to Out-of-bounds Read libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

CVSS Base Scores

version 3.1