Vulnerability Report

CVE-2017-15897

Title: Nodejs Node.Js

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-15897.

CWE Category CWE-665

Published Date Dec 11, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 3.1 CVSS v3.1

Exploit Probability (EPSS)

0.64%

Vulnerability Summary

CVE-2017-15897: Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Impacted Vendors

nodejs 1

joyent 1

Reference Links

https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/

CVSS v3.1

Source Entity [email protected]

Severity LOW

3.1

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns