UnratedFix available
Node.js 6.2.1 (Current)
Node.js 6.2.1 ignores negative lengths in Buffer allocation calls, addressing a possible memory exposure when unchecked user input is passed to the Buffer constructor or allocUnsafe().
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This fixes a possible security concern (reported by Feross Aboukhadijeh) where user input is passed unchecked to the Buffer constructor or allocUnsafe() as it can expose parts of the memory slab used by other Buffers in the application.
Node.js
Node.js 6.2.1 (Current)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 6.2.1
Node.js 6.2.1 (Current)
- Prerequisites
- Not stated in this extraction
Publisher severity
No explicit severity was extracted.
- Event
- #64493 · Revision 1
- Added to Heist Feed
- Publisher date