Executive brief
The byte npm library, commonly used in Node.js applications to convert between different numeric formats and data types, contains a vulnerability where uninitialized buffers are allocated and then read beyond their initialized length. An attacker could exploit this to read sensitive data from adjacent memory, potentially exposing credentials, keys, or other confidential information.
Technical details
The vulnerability is a classic out-of-bounds read (CWE-125) in the byte npm package prior to version 1.4.1. The root cause is the allocation of uninitialized buffers from which data is read past the initialized length, allowing access to unintended memory regions. This is a memory safety issue that could leak sensitive data from the process memory space. The vulnerability affects all versions prior to 1.4.1; a fix was released in version 1.4.1 that properly initializes buffers before use.
Affected products
- npm byte <1.4.1
Timeline
- 2019-06-04: disclosed
- 2019-06-04: patched: version 1.4.1 available