CVE Feed

    Dashboard / CVE / CVE-2014-5256

    CVE-2014-5256

    Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.

    Published:Jul 31, 2014
    Last Modified:Apr 12, 2025
    EPS:Sep 5, 2014
    EPSS Score:0.01474
    CVSS Score:5

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356

    Related CVEs

    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-56848 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2…
    CVE-2026-58042 (CVSS 5.9) — A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than…
    CVE-2026-58044 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-58045 (CVSS 6.2) — A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono…
    CVE-2026-58041 (CVSS 5.3) — A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore…
    CVE-2026-56846 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable re…
    CVE-2026-58039 (CVSS 3.3) — A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --a…
    CVE-2026-56847 (CVSS 6.1) — A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log…
    CVE-2026-56850 (CVSS 4.4) — A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High