CVE-2020-8174: Integer Underflow
A flaw was found in nodejs. Calling napigetvaluestringlatin1(), napigetvaluestringutf8(), or napigetvaluestringutf16() with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer.
Other sources
Calling napigetvaluestringlatin1(), napigetvaluestringutf8(), or napigetvaluestringutf16() with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf, probably overrunning the length of the buffer.
Reference: https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/
— Red Hat
napigetvaluestring() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8174?
CVE-2020-8174 is a vulnerability found in nodejs that allows various kinds of memory corruption.
How does CVE-2020-8174 affect nodejs?
Calling certain functions with a non-NULL buf and bufsize of 0 can cause a buffer overrun.
What is the severity of CVE-2020-8174?
CVE-2020-8174 has a severity value of 8.1 (high).
Which versions of nodejs are affected by CVE-2020-8174?
Nodejs versions < 10.21.0, 12.18.0, and < 14.4.0 are affected by CVE-2020-8174.
How can I fix CVE-2020-8174 in nodejs?
Upgrade to version 10.21.0, 12.18.0, or 14.4.0 or later to fix CVE-2020-8174 in nodejs.