Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Jun 13, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Jun 13, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node8Upgrade node6Upgrade node | Jun 16, 2018 | Jun 15, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Jun 13, 2018 |
| Suse | — | Upgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libgtk-3-0Upgrade libsoftokn3Upgrade firefox-libharfbuzz0Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nspr-32bitUpgrade mozillafirefox-translations-commonUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-amharicUpgrade libsoftokn3-32bitUpgrade mozilla-nsprUpgrade mozillafirefox-branding-sledUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libffi4Upgrade firefox-gtk3-langUpgrade firefox-glib2-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nssUpgrade npm6Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libffi7Upgrade mozilla-nss-certs-32bitUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-certsUpgrade firefox-gtk3-toolsUpgrade libfirefox-gio-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-atk-langUpgrade firefox-gtk3-immodule-ximUpgrade nodejs8-develUpgrade nodejs6-docsUpgrade mozilla-nss-develUpgrade libfreebl3Upgrade firefox-libatk-1_0-0Upgrade libfreebl3-32bitUpgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs6-develUpgrade libfirefox-glib-2_0-0Upgrade npm8Upgrade mozillafirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade mozillafirefoxUpgrade firefox-libcairo2Upgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nss-toolsUpgrade firefox-glib2-toolsUpgrade nodejs6Upgrade nodejs8-docsUpgrade nodejs8 | Jul 17, 2018 | Jun 13, 2018 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Mar 22, 2023 | Jun 13, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub