CVE-2018-7167

High

Description

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

SeverityHigh

CVSS7.5

Exploit probability94. percentile6.7%

Product

Nodejs Node.js

PublishedJun 13, 2018

First seenJun 13, 2018

How to fix

Update

nodejs node.js6.14.3, 8.11.3, 9.11.2 or later

Vendor advisories

security.gentoo.org/glsa/202003-48

Affected products

Product	Affected versions	Fixed in
nodejs node.js	6.9.0 < v < 6.14.3, 8.9.0 ≤ v < 8.11.3, 9.0.0 ≤ v < 9.11.2	6.14.3, 8.11.3, 9.11.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.