Executive brief
concat-stream is a Node.js utility for concatenating streams of data into a single buffer. Versions 1.3.0 through 1.5.1 expose sensitive memory contents if user-controlled numeric input is passed to the write() function. An attacker providing a number instead of expected data could read uninitialized buffer memory, potentially leaking secrets or sensitive system information.
Technical details
The vulnerability exists in concat-stream's handling of numeric input to the write() function. When a number is passed to write() instead of a Buffer or string, the code uses the unguarded Buffer constructor (pre-Node.js v6 behavior), which allocates uninitialized memory of the specified size. This uninitialized buffer is then concatenated with user data, potentially exposing remnants of previous memory allocations. The flaw affects versions 1.3.0–1.5.1 (1.3.0 introduced the vulnerable code path). Versions before 1.3.0 and 1.5.2+ are unaffected. The fix converts numeric inputs to strings before processing. Exploitation requires control over data passed to write(); no network or privilege escalation needed.
Affected products
- npm concat-stream 1.3.0 to 1.3.1, 1.4.0 to 1.4.10, 1.5.0 to 1.5.1
Timeline
- 2019-06-03: disclosed
- 2016-09-01: patched: Fix merged in PR #47 (to-string numbers); affected versions released after this point