What is GHSA-j4mr-9xw3-c9jx?

GHSA-j4mr-9xw3-c9jx is a security advisory published by GitHub Security Advisories with High severity. Out-of-bounds Read in base64-url

Why does GHSA-j4mr-9xw3-c9jx have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-j4mr-9xw3-c9jx?

GHSA-j4mr-9xw3-c9jx affects 1 product, including: npm/base64-url:\u003c 2.0.0.

GHSA-j4mr-9xw3-c9jxHighDisclosed before NVD

Out-of-bounds Read in base64-url

Vendor

GitHub Security Advisories

Published

May 31, 2019

Last Modified

January 9, 2023

📋 Description

Versions of base64-url before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.

Recommendation

Update to version 2.0.0 or later.

🎯 Affected products1

npm/base64-url:< 2.0.0

🔗 References (3)

https://hackerone.com/reports/321692
https://www.npmjs.com/advisories/660
https://github.com/advisories/GHSA-j4mr-9xw3-c9jx