Executive brief
The bigint-buffer library, a utility used in Node.js environments to convert large integers (BigInts) to and from data buffers, is vulnerable to a buffer overflow. An attacker can exploit this flaw to cause the application to crash, leading to a denial-of-service (DoS) condition. This impacts the availability of any service or application that relies on this library for data processing.
Technical details
A buffer overflow vulnerability exists in the bigint-buffer library (versions 0.0.0 through 1.1.5) within the toBigIntLE() function. The flaw is categorized as CWE-120 (Buffer Copy without Checking Size of Input) and occurs when the function processes malformed or unexpected input, such as a null value. An unauthenticated remote attacker can trigger this vulnerability by providing crafted input to an application that uses this function, resulting in a process crash (Denial of Service). While a proof-of-concept exists, there is currently no known fixed version available.
Affected products
- no2chem bigint-buffer 0.0.0 - 1.1.5
Timeline
- 2023-03-20: disclosed: Vulnerability disclosed by researcher Cris Staicu
- 2025-04-03: advisory: Snyk published advisory SNYK-JS-BIGINTBUFFER-3364597
- 2025-04-04: advisory: GitHub Advisory GHSA-3gc7-fjrx-p6mg published