GHSA-3p92-886g-qxpqMediumCVSS 5.1Disclosed before NVD
Remote Memory Exposure in floody
📋 Description
Versions of floody before 0.1.1 are vulnerable to remote memory exposure.
.write(number)in the affectedfloody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.
Proof of Concept:
var f = require('floody')(process.stdout);
f.write(USERSUPPLIEDINPUT);
'f.stop();
## Recommendation
Update to version 0.1.1 or later.
🎯 Affected products1
- npm/floody:< 0.1.1