← CVE Intelligence

CVE-2020-8265

NodeJS / Node PUBLISHED

Description (CNA)

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

Affected (CNA)

Vendor / productVersions
NodeJS / Nodeaffected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.23.1; affected 11.0 before 11.*; affected 12.0 before 12.20.1; affected 13.0 before 13.*; affected 14.0 before 14.15.4; affected 15.0 before 15.5.1

CWE

CWE-416

References

ADP enrichment

CVE

No English description supplied.