Executive brief
Node.js canvas is a popular library used to render and manipulate images in server-side Node.js applications. A buffer overflow vulnerability in versions before 1.6.11 could allow an attacker to crash the application or execute arbitrary code by providing a maliciously crafted image file, potentially compromising the server and its data.
Technical details
A buffer overflow vulnerability (CWE-120) exists in the canvas library's image processing code, specifically in JPEG handling. The vulnerability is triggered when the library processes user-supplied image data without proper bounds checking. An attacker can exploit this by crafting a malicious image file and providing it to an application using the vulnerable canvas library. The attack requires user interaction (uploading or processing an image) but no authentication. Successful exploitation can lead to denial of service or arbitrary code execution with the privileges of the Node.js process. The vulnerability is fixed in version 1.6.11 and later.
Affected products
- Automattic node-canvas before 1.6.11
Timeline
- 2021-05-07: disclosed
- 2020-07-20: patched: Fix available in version 1.6.11