CVE-2024-21524

HIGH

Magiclen Stringbuilder < 2.2.7 - Out-of-Bounds Read

Title source: rule

Description

All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling ToBuffer, ToString, or CharAt on a StringBuilder object with a non-empty string value input. It's possible to return previously allocated memory, for example, by providing negative indexes, leading to an Information Disclosure.

References (3)

Core 3

Core References

Exploit, Third Party Advisory

https://gist.github.com/dellalibera/0bb022811224f81d998fa61c3175ee67

Broken Link

https://github.com/magiclen/node-stringbuilder/blob/5c2797d3d6bf8cb6d10fe1e077609cef9a5a7de0/src/node-stringbuilder.c%23L1281

Exploit, Third Party Advisory

https://security.snyk.io/vuln/SNYK-JS-NODESTRINGBUILDER-6421617

Scores

CVSS v3 8.2

EPSS 0.0021

EPSS Percentile 43.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-125

Status published

Products (2)

magiclen/stringbuilder < 2.2.7

npm/node-stringbuilder 0npm

Published Jul 10, 2024

Tracked Since Feb 18, 2026