Name: CVE-2020-8174: Improper Restriction of Operations within the Bounds of a Memory Buffer
Published: 2020-07-24T00:00:00.000Z
Keywords: CVE, CVE-2020-8174, CWE-119, CWE-191, CVSS 8.1, EPSS 0.07646

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

CVSS Details

CVSS 3.1 Base Score: 8.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	View advisory ↗View advisory ↗View advisory ↗	alma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packaging	May 4, 2022	Jul 24, 2020
Alpine Linux	View advisory ↗View advisory ↗	alpine-linux-upgrade-nodejsalpine-linux-upgrade-nodejs-current	Aug 22, 2024	Jul 24, 2020
Centos_linux	—	centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-npm	Jul 8, 2020	Jul 7, 2020
Debian	View advisory ↗	debian-upgrade-nodejs	Jun 8, 2020	Jun 8, 2020
Freebsd	View advisory ↗	freebsd-upgrade-package-nodefreebsd-upgrade-package-node12freebsd-upgrade-package-node10	Jun 13, 2020	Jun 12, 2020
Gentoo Linux	View advisory ↗	gentoo-linux-upgrade-net-libs-nodejs	Jan 12, 2021	Jul 24, 2020
Oracle Solaris	View advisory ↗	oracle-solaris-11-4-upgrade-runtime-nodejs-12-18-3-11-4-26-0-1-75-3oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-10-10-22-0-11-4-26-0-1-75-3oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-12-12-18-3-11-4-26-0-1-75-3	Jan 19, 2021	Jul 24, 2020
Oracle_linux	—	oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-npm	Jul 22, 2020	Jun 2, 2020
Redhat_linux	View advisory ↗	redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm	Jul 8, 2020	Jul 7, 2020
Suse	—	suse-upgrade-nodejs10suse-upgrade-nodejs10-develsuse-upgrade-nodejs10-docssuse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-nodejs6suse-upgrade-nodejs6-develsuse-upgrade-nodejs6-docssuse-upgrade-nodejs8suse-upgrade-nodejs8-develsuse-upgrade-nodejs8-docssuse-upgrade-npm10suse-upgrade-npm12suse-upgrade-npm14suse-upgrade-npm6suse-upgrade-npm8	Jun 10, 2020	Jun 9, 2020
Ubuntu	View advisory ↗	ubuntu-pro-upgrade-nodejsubuntu-pro-upgrade-nodejs-devubuntu-pro-upgrade-nodejs-legacyubuntu-upgrade-libnode-devubuntu-upgrade-libnode64ubuntu-upgrade-nodejs	Sep 20, 2023	Jul 24, 2020
Vmware Photon_os	View advisory ↗	vmware-photon_os_update_tdnf	Jan 20, 2025	Jul 24, 2020

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub