UpHeron
All vulnerabilities

Servers and applications

CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Severity
Low 3.1
Published
11 Dec 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.9.3, 9.2.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 8.0.0 up to 8.8.1
  • From 8.9.0 before 8.9.3
  • From 9.0.0 before 9.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-15897
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-15897