Executive brief
stringstream is a Node.js library for converting data streams between different text encodings. A flaw in buffer allocation causes the library to read beyond allocated memory when processing numeric input on Node.js 4.x and earlier, potentially exposing sensitive data from memory. Applications using this library with untrusted user input are at risk of information disclosure.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the AlignedStringDecoder component of stringstream, which allocates uninitialized buffers when numeric data is passed to the input stream on Node.js 4.x and below. The flaw occurs in the alignedWrite function when handling base64 encoding operations. An attacker can supply crafted numeric input to trigger a read beyond the bounds of allocated memory, leading to disclosure of sensitive data from process memory. All versions prior to 0.0.6 are affected; however, no fix is currently available according to the advisory.
Affected products
- npm stringstream all versions before 0.0.6
Timeline
- 2019-06-20: disclosed
- 2020-12-03: other: NVD published