Executive brief
npmconf is a configuration management library used by npm and Node.js applications to store and retrieve settings. Versions before 2.1.3 accidentally allocate and write uninitialized memory to disk when certain malformed configuration inputs are provided, potentially exposing sensitive data from memory. The vulnerability primarily affects applications running on older Node.js 4.x environments and can lead to unintended data disclosure.
Technical details
This is an out-of-bounds read (CWE-125) vulnerability in npmconf's config parsing logic. When a typed number is passed as input on Node.js 4.x, the library fails to properly initialize memory before writing to disk, causing uninitialized heap contents to be persisted. The vulnerability is triggered during config handling without requiring authentication or special privileges. An attacker can exploit this by providing crafted numeric inputs to the configuration parser, resulting in exposure of sensitive data that was previously in memory. The fix is available in version 2.1.3 and later; the project maintainers also recommend migrating away from the deprecated npmconf library entirely to a modern alternative.
Affected products
- npm npmconf <2.1.3
Timeline
- 2019-06-12: disclosed
- 2019-06-12: patched: Version 2.1.3 released with fix