Use-After-Free Vulnerability in Node.js TLS Implementation (CVE-2020-8265)
Summary
CVE-2020-8265: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. Affects nodejs across 2 version ranges.
< 12.20.1-r0
>= cf41627411886000429bde058a6594fb7f6d6d47, < 811be91dfe623c7569f5fd87b1eaf46074334c94
Fixed in 12.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. The TLS (Transport Layer Security) implementation in Node.js provides secure communication over the network. However, versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 are vulnerable to a use-after-free bug in the TLS implementation.
Vulnerability Detail
The use-after-free vulnerability occurs when writing to a TLS enabled socket. The vulnerable code in node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. An attacker can exploit this vulnerability to corrupt memory, leading to a Denial of Service (DoS) or potentially other exploits.
How To Fix
Minimum fixed version
12.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Node.js is not immediately feasible, a possible workaround is to disable TLS in affected applications until the update can be applied. However, this workaround may impact the security and functionality of the application, so updating to a patched version is strongly recommended.
Conclusion
The use-after-free vulnerability in Node.js TLS implementation (CVE-2020-8265) can have serious security implications, including Denial of Service (DoS) attacks and potential code execution. It is crucial to update Node.js to the patched versions mentioned or disable TLS in affected applications until the update can be applied. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications.
TLS (Transport Layer Security) is a cryptographic protocol that provides secure communication over the network. It ensures the confidentiality and integrity of data transmitted between client and server.
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a crash.
The use-after-free vulnerability in Node.js TLS implementation can lead to a Denial of Service (DoS) attack or potentially allow an attacker to execute arbitrary code. It is important to update to a patched version to mitigate these risks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
