Executive brief
The base64-url library, used in Node.js applications to encode and decode data in base64 format, contains a vulnerability that allows attackers to read uninitialized memory. When a number is passed as input, the library allocates memory without initializing it, potentially exposing sensitive data from adjacent memory regions to an attacker who can control the input.
Technical details
This is an out-of-bounds read vulnerability (CWE-125) in the base64-url npm package versions prior to 2.0.0. The root cause is the allocation of uninitialized Buffers when a number is passed as input. An attacker can trigger the vulnerability by supplying a numeric input to the library, causing it to read beyond allocated buffer boundaries and leak uninitialized memory contents. No authentication or network access is required—only the ability to pass input to an affected application using the vulnerable library. The vulnerability has been fixed in version 2.0.0 and later.
Affected products
- npm base64-url < 2.0.0
Timeline
- 2019-05-31: disclosed
- 2019-05-31: patched: Fix available in version 2.0.0