CVE-2017-15897 Information disclosure in Node.js
Improper buffer initialization in Node.js may expose sensitive memory contents when encoding mismatches occur during buffer allocation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15897?
CVE-2017-15897 is a low-severity vulnerability in Nodejs Node.js, published on 11 Dec 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
Weakness: CWE-665
Which versions are affected by CVE-2017-15897?
It affects 1 product.
Products include Nodejs Node.js.
How do I fix CVE-2017-15897?
Upgrade to a fixed version.
Is CVE-2017-15897 being exploited?
There is no known exploitation of CVE-2017-15897 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2017-15897, CLEANSTART-2026-BR75725, CLEANSTART-2026-ID13469, GHSA-f2j2-5fh3-4jrr.