GHSA-3p92-886g-qxpqMediumCVSS 5.1Disclosed before NVD

Remote Memory Exposure in floody

Published
June 4, 2019
Last Modified
January 9, 2023

📋 Description

Versions of floody before 0.1.1 are vulnerable to remote memory exposure.

.write(number)in the affectedfloody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.

Proof of Concept:

var f = require('floody')(process.stdout); 
f.write(USERSUPPLIEDINPUT); 
'f.stop();


## Recommendation

Update to version 0.1.1 or later.

🎯 Affected products1

  • npm/floody:< 0.1.1

🔗 References (4)