Out-of-Bounds Read Vulnerability in Node.js stringstream
Summary
GHSA-qpw2-xchm-655q: Out-of-Bounds read in stringstream. Affects stringstream versions < 0.0.6. Fixed in 0.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stringstream module is an npm package used in Node.js applications for handling streams of data. It provides functionality for reading and writing data to streams. However, versions prior to 0.0.6 of the stringstream module are vulnerable to an out-of-bounds read issue. This vulnerability occurs when uninitialized buffers are allocated in the input stream, specifically when a number is passed in the stream. This vulnerability affects applications using Node.js 4.x.
Vulnerability Detail
The out-of-bounds read vulnerability in the stringstream module can lead to potential security risks. An attacker could exploit this vulnerability to read sensitive information from memory or cause a denial-of-service by crashing the application. The vulnerability is rated as moderate severity with a CVSS score of 6.5. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-125.
How To Fix
Minimum fixed version
0.0.6
This is the first release that contains the fix.
npm install stringstream@0.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to a fixed version of the stringstream module.
Conclusion
The out-of-bounds read vulnerability in the stringstream module of Node.js can pose security risks to applications using Node.js 4.x. It is crucial to upgrade to version 0.0.6 or higher of the stringstream module to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for stringstream →
FAQ
The vulnerability can allow an attacker to read sensitive information from memory or cause a denial-of-service by crashing the application.
This vulnerability affects applications using Node.js 4.x.
The vulnerability is rated as moderate severity with a CVSS score of 6.5.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to a fixed version of the stringstream module.
To fix this vulnerability, it is recommended to upgrade the stringstream module to version 0.0.6 or higher. This can be done by updating the package.json file of the Node.js application and running the package manager to install the latest version of the module. For example, using npm, the command would be: npm install stringstream@0.0.6
References
Related vulnerabilities
Recent vulnerabilities recorded for stringstream.
