CVE-2018-12115 Memory corruption in Node.js

High 7.5 Published 21 Aug 2018 Updated 15 Oct 2026

Buffer overflow in Node.js UCS-2 encoding allows attackers to write outside buffer bounds, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-12115?

CVE-2018-12115 is a high-severity memory corruption vulnerability in Nodejs Node.js, published on 21 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.

Weakness: CWE-787

Which versions are affected by CVE-2018-12115?

It affects 2 products.

Linux distribution packages (8)

`rh-nodejs6-nodejs` Red Hat:rhel_software_collections:3::el6	All versions	`0:6.11.3-6.el6`
`rh-nodejs6-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el6	All versions	`0:6.11.3-6.el6`
`rh-nodejs6-nodejs-devel` Red Hat:rhel_software_collections:3::el6	All versions	`0:6.11.3-6.el6`
`rh-nodejs6-nodejs-docs` Red Hat:rhel_software_collections:3::el6	All versions	`0:6.11.3-6.el6`
`rh-nodejs6-nodejs` Red Hat:rhel_software_collections:3::el7	All versions	`0:6.11.3-7.el7`
`rh-nodejs6-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el7	All versions	`0:6.11.3-7.el7`
`rh-nodejs6-nodejs-devel` Red Hat:rhel_software_collections:3::el7	All versions	`0:6.11.3-7.el7`
`rh-nodejs6-nodejs-docs` Red Hat:rhel_software_collections:3::el7	All versions	`0:6.11.3-7.el7`

Products include Nodejs Node.js, Redhat Openshift Container Platform.

How do I fix CVE-2018-12115?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-12115 being exploited?

There is no known exploitation of CVE-2018-12115 in the wild and no public exploit code.

All Nodejs Node.js vulnerabilities

Sources

Also known as ALPINE-CVE-2018-12115, CLEANSTART-2026-QB23308, CLEANSTART-2026-RX03118, DEBIAN-CVE-2018-12115, GHSA-q85m-543x-pwpc, RHSA-2018:2944 and 1 more.