CVE-2017-15897
LOWNode.js 8.0.0-8.8.0 and 8.9.0-8.9.2 - Improper Buffer Initialization
Title source: llmDescription
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
References (1)
Core 1
Core References
Issue Tracking, Vendor Advisory x_refsource_confirm
https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
Scores
CVSS v3
3.1
EPSS
0.0064
EPSS Percentile
70.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-665
Status
published
Products (4)
nodejs/node.js
8.0.0 - 8.8.1
nodejs/node.js
8.9.0 - 8.9.3
The Node.js Project/Node.js
8.0 and higher
The Node.js Project/Node.js
9.0 and higher
Published
Dec 11, 2017
Tracked Since
Feb 18, 2026