← Back

CVE-2017-15897

nvd nist
Published: Dec 11, 2017Modified: May 13, 2026

JSON object

Loading...
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.6 / Impact: 1.4
Source: NVD

Description

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Affected (3)

Products: Nodejs: Node.js
Nodejs
1 product
Node.js
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Nodejs
Node.js
From 8.0.0 to 8.8.1
Node.js
From 9.0.0 to 9.2.1
Node.js
From 8.9.0 to 8.9.3

Related CWEs

CWE-665
Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

References (2)

Source: cve-request@iojs.org
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory

Timeline

No history available yet.