CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified

published December 11, 2017

CVSS
—
EPSS
2%
Percentile
83.3
In the wild
Unconfirmed
What it is

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02322 · 83.3th percentile
Published
2017-12-11T21:00Z
EPSS history
Timeline
  • 11 DEC 21:00Z
    Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified
    cvelistv5