Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Jun 13, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Jun 13, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade nodeUpgrade node8Upgrade node6 | Jun 16, 2018 | Jun 15, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Jun 13, 2018 |
| Suse | — | Upgrade nodejs6-develUpgrade mozillafirefoxUpgrade nodejs8-develUpgrade libfirefox-glib-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-develUpgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-libpango-1_0-0Upgrade mozillafirefox-translations-otherUpgrade nodejs8-docsUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-ximUpgrade libfreebl3-32bitUpgrade nodejs6-docsUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libcairo2Upgrade firefox-atk-langUpgrade firefox-gtk3-branding-upstreamUpgrade nodejs8Upgrade firefox-gio-branding-upstreamUpgrade mozilla-nss-toolsUpgrade nodejs6Upgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-toolsUpgrade libfirefox-gio-2_0-0Upgrade npm8Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-dataUpgrade firefox-libffi4Upgrade mozilla-nssUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-glib2-langUpgrade npm6Upgrade firefox-libgtk-3-0Upgrade firefox-libharfbuzz0Upgrade mozilla-nsprUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-thaiUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-langUpgrade libsoftokn3Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi7Upgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nspr-32bitUpgrade mozillafirefox-branding-sledUpgrade firefox-libcairo-gobject2Upgrade mozillafirefox-translations-common | Jul 17, 2018 | Jun 13, 2018 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Mar 22, 2023 | Jun 13, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub