Unscored severity · published Sep 5, 2014
CVE-2014-5256
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt,…
–
CVSS
3.3%
EPSS
No
On KEV
Description
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Nodejs · Nodejs
0.8.0; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5256
advisories.mageia.org
http://advisories.mageia.org/MGASA-2014-0516.html
Patch
http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/
secunia.com
http://secunia.com/advisories/61260
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21684769
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2015:142
Exploit
https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356
More from Nodejs
8.1
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /…
7.7
CVE-2023-30584
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
7.5
CVE-2023-30587
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector)
7.5
CVE-2023-30583
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20
7.4
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack -…