CVE-2018-7166
HighCVSS 7.5Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
Risk Assessment
This can lead to leakage of sensitive information from memory, posing a serious risk to data confidentiality. Node.js applications processing user input are exposed.
Recommendation
Update Node.js to version 10.9.0 or later. Avoid passing untrusted data as arguments to Buffer.alloc().
Other vulnerabilities in Node.js
See all- CVE-2026-21637High
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.
- CVE-2025-59466High
A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- CVE-2025-59464High
A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.
- CVE-2025-23166High
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs, potentially allowing an adversary to remotely crash a Node.js runtime.
- CVE-2025-23085Medium
A memory leak occurs in Node.js when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when nghttp2 detects an invalid header and terminates the connection. This can lead to increased memory consumption and potential denial of service.
- CVE-2024-22018Low
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API, allowing malicious actors to retrieve stats from files they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
- CVE-2024-22020Medium
A flaw in Node.js allows bypassing network import restrictions by embedding non-network imports in data URLs. This enables an attacker to execute arbitrary code and compromise system security.
- CVE-2024-27982Medium
A critical vulnerability was identified in the HTTP server of the most recent Node version, where malformed headers can lead to HTTP request smuggling. Specifically, placing a space before a content-length header causes it to be misinterpreted, enabling attackers to smuggle a second request within the body of the first.
- CVE-2024-27983High
An attacker can make a Node.js HTTP/2 server completely unavailable by sending a small number of HTTP/2 frame packets. Data can remain in nghttp2 memory after a reset when headers with an HTTP/2 CONTINUATION frame are sent and the client abruptly closes the TCP connection, triggering a race condition.
- CVE-2015-7384High
Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.
Original NVD description (English source)
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS