Low severity · published Dec 11, 2017
CVE-2017-15897
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified
3.1
CVSS
2.3%
EPSS
No
On KEV
Description
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node.js · Nodejs
8.0.0 through 8.8.1; 8.9.0 before 8.9.3; 9.0.0 before 9.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15897
Issue Tracking
https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
More from Node.js
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.8
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific…
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user