base64url out-of-bounds read in Buffer allocation

Severity: info · Published 2020-09-01

Vendors: npm.

Executive brief

base64url is a Node.js library for encoding and decoding base64 data. Versions before 3.0.0 contain a memory safety flaw that can expose uninitialized buffer contents when processing numeric input on Node.js 4.x and earlier, potentially leaking sensitive data from memory.

Technical details

The vulnerability is an out-of-bounds read (CWE-125) in the base64url library caused by uninitialized Buffer allocation. When a number is passed as input to the encoding function on Node.js 4.x and below, the library allocates a Buffer without zero-filling it, leaving previously allocated memory contents accessible. An attacker providing numeric input can trigger reads of uninitialized memory. The fix, released in version 3.0.0, validates input and ensures Buffers are properly zero-filled before use.

base64url out-of-bounds read in Buffer allocation

Executive brief

Technical details

Affected products

Timeline

References