Out-of-bounds Read in byte
Summary
GHSA-xm7f-x4wx-wmgv: Out-of-bounds Read in byte. Affects byte versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The byte package is an npm package that provides functionality for working with bytes. It is used to allocate and manipulate byte buffers in JavaScript applications. The package is vulnerable to an out-of-bounds read issue in versions prior to 1.4.1. This vulnerability occurs when uninitialized buffers are allocated and data is read from them beyond their initialized length.
Vulnerability Detail
The out-of-bounds read vulnerability in the byte package can lead to information disclosure or crashes in applications that use the package. An attacker could potentially exploit this vulnerability to read sensitive data from uninitialized memory or cause the application to crash by accessing invalid memory locations. The vulnerability is classified as moderate severity and has been assigned the Common Weakness Enumeration (CWE) ID 125.
How To Fix
Latest published version: 2.0.0 as of 23 Oct 2026
npm install byte@2.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
npm install byte@1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The byte package is vulnerable to an out-of-bounds read issue that can lead to information disclosure or crashes in applications. It is recommended to update the package to version 1.4.1 or later to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for byte →
FAQ
The vulnerability can lead to information disclosure or crashes in applications that use the byte package. It could potentially allow an attacker to read sensitive data or cause the application to crash.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to update the byte package to the fixed version.
The vulnerability is classified as moderate severity.
There are no known exploits for this vulnerability at the moment.
