Executive brief
The put npm package incorrectly calculates buffer sizes and exposes uninitialized memory containing potentially sensitive data. This affects applications using the package with Node.js 6.x and earlier. An attacker could potentially read uninitialized memory regions to access data that should have been restricted.
Technical details
The vulnerability is an uninitialized memory exposure (CWE-200) in the put npm package. The root cause is improper buffer size calculation and failure to trim written bytes, leaving uninitialized memory accessible in the returned buffer. The issue only manifests on Node.js versions 6.x and earlier. An attacker with access to data processed by put can read beyond the intended buffer boundaries to access uninitialized memory. The recommended mitigation is to upgrade to Node.js 7.x or later, or switch to an alternative package.
Affected products
- npm put all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory