CVE-2017-15897

    Dashboard / Vulnerabilities / CVE-2017-15897

    CVE-2017-15897

    Published: 11 Dec 2017Last Modified: 8 Jul 2026

    Summary:

    Details: Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

    References: https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba
    Fixed -None

    Affected versions

    v8.9.2
    v8.9.1
    v8.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-15897 | CVE-DB