Buffer overflow in Node.js
CVE-2014-5256
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
Vulnerability class: Buffer Overflow
EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.
Affected products
- Nodejs — versions 0.8.0, 0.8.1, 0.8.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM, Exploit)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
Frequently asked questions
- What is CVE-2014-5256?
- CVE-2014-5256 is a vulnerability in Node.js, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-09-05.
- Is CVE-2014-5256 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.