Executive brief
The stringstream Node.js library contains a vulnerability that exposes uninitialized memory when processing numeric input on Node.js versions 4.x and earlier. An attacker can read sensitive data from memory buffers that were not properly initialized, potentially exposing application secrets, credentials, or other confidential information.
Technical details
The vulnerability is a CWE-125 out-of-bounds read caused by allocation of uninitialized buffers when numeric values are passed through the input stream. The flaw occurs in Node.js 4.x and earlier versions due to how buffers are allocated without initialization. The vulnerable versions (all prior to 0.0.6) can be exploited by an attacker with network access sending crafted input containing numbers to the stringstream module. The attack requires no authentication or user interaction. A fix is available in version 0.0.6 and later.
Affected products
- npm stringstream before 0.0.6
Timeline
- 2018-05-14: disclosed
- 2018: patched: Fixed in version 0.0.6
- 2022-01-06: advisory