CVE-2017-15897 - CVE House
Back to Database
Status published Low CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which...

Vulnerability Description

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-15897

Credits & Attribution

No credits recorded in the NVD database.

References

More from The Node.js Project

View All →
CVE-2018-7167
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to...
High 7.5
CVE-2018-7166
In all versions of Node.js 10 prior to 10.9.0, an...
High 7.5
CVE-2018-7164
Node.js versions 9.7.0 and later and 10.x are vulnerable and...
High 7.5
CVE-2018-7162
All versions of Node.js 9.x and 10.x are vulnerable and...
High 7.5
CVE-2018-7161
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable...
High 7.5

Affected Vendor

The Node.js Project

View all reports →

Affected Software

Node.js
Vulnerable Versions:
8.0 and higher, 9.0 and higher

Timeline

Official Publish: December 11th, 2017
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.