Skip to content
Fencer Intel
high 7.5

CVE-2018-7166 json

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory.

published 2018-08-21 8 y ago modified 2026-10-08 31 d ago also EUVD-2018-18908

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.

Patch / fix

  • nodejs node.js 10.9.0
  • npm openshift application runtimes 1.0 1:6.2.0-1.10.9.0.1.el7
  • rhoar-nodejs openshift application runtimes 1.0 1:10.9.0-1.el7
  • rh-nodejs10-npm RHEL 3 SOFTWARE_COLLECTIONS 6.4.1-10.10.0.3.el7
  • rh-nodejs10-nodejs RHEL 3 SOFTWARE_COLLECTIONS 10.10.0-3.el7

red hat advisories RHSA-2018:2553RHBA-2019:0772

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-7166 updated cvss 5.3

nodejs: Unintentional exposure of uninitialized memory

  • Red Hat OpenShift Application Runtimes Node.js 10 npm 6.2.0-1.10.9.0.1.el7, rhoar-nodejs 10.9.0-1.el7
    fixed: vendor fix RHSA-2018:2553
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs 10.10.0-3.el7, rh-nodejs10-npm 6.4.1-10.10.0.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nodejs10-nodejs 10.10.0-3.el7, rh-nodejs10-npm 6.4.1-10.10.0.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-nodejs 10.10.0-3.el7, rh-nodejs10-npm 6.4.1-10.10.0.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs 10.10.0-3.el7, rh-nodejs10-npm 6.4.1-10.10.0.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs 10.10.0-3.el7, rh-nodejs10-npm 6.4.1-10.10.0.3.el7
    fixed: vendor fix RHBA-2019:0772
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat OpenShift Application Runtimes nodejs Red Hat OpenShift Container Platform 3.2 nodejs Red Hat OpenShift Container Platform 3.3 nodejs Red Hat OpenShift Container Platform 3.4 nodejs Red Hat OpenShift Container Platform 3.5 nodejs
    +7 more products
    Red Hat OpenShift Container Platform 3.6 nodejs Red Hat OpenShift Container Platform 3.7 nodejs Red Hat OpenShift Container Platform 3.9 nodejs Red Hat OpenShift Container Platform 3.10 nodejs Red Hat OpenShift Container Platform 3.11 nodejs Red Hat OpenShift Enterprise 3.1 nodejs Red Hat Software Collections rh-nodejs8-npm, rh-nodejs4-nodejs, rh-nodejs6-nodejs, rh-nodejs8-nodejs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

3.29% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • The Node.js Project Node.js

Classification

Weakness
  • CWE-226 Sensitive Information in Resource Not Removed Before Reuse
  • CWE-908 Use of Uninitialized Resource
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.