In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Aug 21, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Aug 21, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node6Upgrade nodeUpgrade node8 | Aug 28, 2018 | Aug 25, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Aug 21, 2018 |
| Redhat Openshift | — | Upgrade atomic-openshift | Jan 4, 2019 | Aug 11, 2018 |
| Suse | — | Upgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade nodejs6-docsUpgrade firefox-gtk3-toolsUpgrade libfirefox-gio-2_0-0Upgrade nodejs8-develUpgrade nodejs6-develUpgrade npm8Upgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade firefox-libgtk-3-0Upgrade mozilla-nssUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-atk-langUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs8Upgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gdk-pixbuf-langUpgrade libfreebl3-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libcairo-gobject2Upgrade nodejs4Upgrade nodejs10Upgrade nodejs4-docsUpgrade firefox-gtk3-langUpgrade npm4Upgrade nodejs10-develUpgrade firefox-libharfbuzz0Upgrade libsoftokn3-32bitUpgrade mozilla-nss-32bitUpgrade firefox-glib2-toolsUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-dataUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libffi4Upgrade firefox-libatk-1_0-0Upgrade nodejs10-docsUpgrade firefox-libpango-1_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-glib2-langUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs4-develUpgrade MozillaFirefoxUpgrade npm6Upgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-develUpgrade MozillaFirefox-translations-commonUpgrade firefox-libcairo2Upgrade nodejs6Upgrade npm10Upgrade MozillaFirefox-translations-otherUpgrade libsoftokn3 | Sep 12, 2018 | Aug 21, 2018 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro) | Mar 22, 2023 | Aug 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub