Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron") 8.x (LTS "Carbon") and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

🗓️ 06 Jun 2021 00:00:00Reported by MicrosoftType

Buffer.fill and Buffer.alloc can hang and cause DoS; now zero fill; vulnerable: Node.js six to nine; ten safe.

Reporter	Title	Published	Views	Family All 104
ALT Linux	Security fix for the ALT Linux 10 package node version 8.11.3-alt1	30 Jun 201800:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161)	26 Sep 201818:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11	20 Nov 201812:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	11 Sep 201818:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by multiple third-party vulnerabilities (Node.js, nghttp2, Linux, Intel CPU, Android)	31 Oct 201820:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateways is affected by a Denial of Service vulnerability (CVE-2018-7167)	20 Sep 201813:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	15 Sep 202219:20	–	ibm
FreeBSD	node.js -- multiple vulnerabilities	12 Jun 201800:00	–	freebsd
AlpineLinux	CVE-2018-7167	13 Jun 201816:00	–	alpinelinux