CVE-2018-7166

{"containers": {"cna": {"affected": [{"product": "Node.js", "vendor": "The Node.js Project", "versions": [{"status": "affected", "version": "All versions of Node.js 10 prior to 10.9.0"}]}], "datePublic": "2018-08-12T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-226", "description": "CWE-226: Sensitive Information Uncleared Before Release", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-08-23T09:57:01.000Z", "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "shortName": "nodejs"}, "references": [{"name": "RHSA-2018:2553", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2018:2553"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-request@iojs.org", "DATE_PUBLIC": "2018-08-12T00:00:00", "ID": "CVE-2018-7166", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Node.js", "version": {"version_data": [{"version_value": "All versions of Node.js 10 prior to 10.9.0"}]}}]}, "vendor_name": "The Node.js Project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-226: Sensitive Information Uncleared Before Release"}]}]}, "references": {"reference_data": [{"name": "RHSA-2018:2553", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2018:2553"}, {"name": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "refsource": "CONFIRM", "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:24:11.399Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2018:2553", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2018:2553"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-7166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T21:12:11.382077Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:14:05.567Z"}}]}, "cveMetadata": {"assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "assignerShortName": "nodejs", "cveId": "CVE-2018-7166", "datePublished": "2018-08-21T13:00:00.000Z", "dateReserved": "2018-02-15T00:00:00.000Z", "dateUpdated": "2026-10-08T21:14:05.567Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2018:2553", "name": "RHSA-2018:2553", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:24:11.399Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-7166", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T21:12:11.382077Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:12:11.864Z"}}], "cna": {"affected": [{"vendor": "The Node.js Project", "product": "Node.js", "versions": [{"status": "affected", "version": "All versions of Node.js 10 prior to 10.9.0"}]}], "datePublic": "2018-08-12T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2018:2553", "name": "RHSA-2018:2553", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-226", "description": "CWE-226: Sensitive Information Uncleared Before Release"}]}], "providerMetadata": {"orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "shortName": "nodejs", "dateUpdated": "2018-08-23T09:57:01.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "All versions of Node.js 10 prior to 10.9.0"}]}, "product_name": "Node.js"}]}, "vendor_name": "The Node.js Project"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://access.redhat.com/errata/RHSA-2018:2553", "name": "RHSA-2018:2553", "refsource": "REDHAT"}, {"url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "name": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-226: Sensitive Information Uncleared Before Release"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-7166", "STATE": "PUBLIC", "ASSIGNER": "cve-request@iojs.org", "DATE_PUBLIC": "2018-08-12T00:00:00"}}}}, "cveMetadata": {"cveId": "CVE-2018-7166", "state": "PUBLISHED", "dateUpdated": "2026-10-08T21:14:05.567Z", "dateReserved": "2018-02-15T00:00:00.000Z", "assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "datePublished": "2018-08-21T13:00:00.000Z", "assignerShortName": "nodejs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Node.js", "vendor": "The Node.js Project", "versions": [{"status": "affected", "version": "All versions of Node.js 10 prior to 10.9.0"}]}], "source": "cve-request@iojs.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*", "matchCriteriaId": "48A01678-361E-4F23-B7D6-41B0C145F491", "versionEndExcluding": "10.9.0", "versionStartIncluding": "10.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."}, {"lang": "es", "value": "En todas las versiones de Node.js 10 anteriores a la 10.9.0, un fallo en el procesamiento de argumentos puede provocar que \"Buffer.alloc()\" devuelva memoria no inicializada. Este m\u00e9todo est\u00e1 dise\u00f1ado para ser seguro y solo devuelve la memoria inicializada o borrada. El tercer argumento que especifica \"encoding\" puede ser pasado como un n\u00famero. Esto es malinterpretado por el m\u00e9todo interno \"fill\" del b\u00fafer como el \"comienzo\" de una operaci\u00f3n de llenado (fill). Este defecto puede ser explotado cuando los argumentos \"Buffer.alloc()\" se derivan de la entrada del usuario para devolver bloques de memoria no borrados que pueden contener informaci\u00f3n sensible."}], "id": "CVE-2018-7166", "lastModified": "2026-10-08T22:16:48.227", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-7166", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T21:12:11.382077Z", "version": "2.0.3"}}]}, "published": "2018-08-21T12:29:00.320", "references": [{"source": "cve-request@iojs.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:2553"}, {"source": "cve-request@iojs.org", "tags": ["Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2018:2553"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/"}], "sourceIdentifier": "cve-request@iojs.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-226"}], "source": "cve-request@iojs.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2018:2553", "cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0::el7", "package": "rhoar-nodejs-1:10.9.0-1.el7", "product_name": "Red Hat OpenShift Application Runtimes Node.js 10", "release_date": "2018-08-22T00:00:00Z"}, {"advisory": "RHBA-2019:0772", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.10.0-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2019-04-17T00:00:00Z"}, {"advisory": "RHBA-2019:0772", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.10.0-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS", "release_date": "2019-04-17T00:00:00Z"}, {"advisory": "RHBA-2019:0772", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.10.0-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS", "release_date": "2019-04-17T00:00:00Z"}, {"advisory": "RHBA-2019:0772", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs10-nodejs-0:10.10.0-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS", "release_date": "2019-04-17T00:00:00Z"}], "bugzilla": {"description": "nodejs: Unintentional exposure of uninitialized memory", "id": "1620215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1620215"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-200", "details": ["In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information."], "name": "CVE-2018-7166", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Application Runtimes"}, {"cpe": "cpe:/a:redhat:openshift:3.10", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.10"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.2", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.2"}, {"cpe": "cpe:/a:redhat:openshift:3.3", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.3"}, {"cpe": "cpe:/a:redhat:openshift:3.4", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.4"}, {"cpe": "cpe:/a:redhat:openshift:3.5", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.5"}, {"cpe": "cpe:/a:redhat:openshift:3.6", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.6"}, {"cpe": "cpe:/a:redhat:openshift:3.7", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.7"}, {"cpe": "cpe:/a:redhat:openshift:3.9", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Container Platform 3.9"}, {"cpe": "cpe:/a:redhat:openshift:3.1", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Enterprise 3.1"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs4-nodejs", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs6-nodejs", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs8-nodejs", "product_name": "Red Hat Software Collections"}], "public_date": "2018-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-7166\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-7166"], "threat_severity": "Moderate"}

{}