EUVD-2018-18908

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Node.js 10 versions before 10.9.0 have a flaw that yields uninitialized memory from Buffer.alloc()

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	14 Sep 202215:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities were identified in Node.js that affect IBM Cloud App Management V2018	15 Feb 201911:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by OpenSSL vulnerabilities (CVE-2018-0732 CVE-2018-12115 CVE-2018-7166 CVE-2018-0737)	23 Oct 201815:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by multiple Node.js vulnerabilities	13 Nov 201815:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11	20 Nov 201812:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	11 Sep 201818:41	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js as used in IBM QRadar Packet Capture is susceptible to multiple vulnerabilities	7 Nov 201815:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private (CVE-2018-0732, CVE-2018-12115, CVE-2018-7166, CVE-2018-0737)	17 Dec 201818:10	–	ibm
CNVD	Unspecified vulnerability in Joyent Node.js (CNVD-2019-42560)	23 Aug 201800:00	–	cnvd
CVE	CVE-2018-7166	21 Aug 201813:00	–	cve

[
  {
    "enisaIdVendor": [
      {
        "id": "4139a7b3-6022-30d1-86ff-46b5216889b6",
        "vendor": {
          "name": "The Node.js Project"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "d11a6b36-b0c7-36d0-abdb-d759ca2bc206",
        "product": {
          "name": "Node.js"
        },
        "product_version": "All versions of Node.js 10 prior to 10.9.0"
      }
    ]
  }
]

Source	Link
suse	www.suse.com/security/cve/CVE-2018-7166.html
access	www.access.redhat.com/errata/RHBA-2019:0772
access	www.access.redhat.com/errata/RHSA-2018:2553
nodejs	www.nodejs.org/en/blog/vulnerability/august-2018-security-releases/
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

CVSS 25

EPSS0.0086