Read the docs
TI-2020-19616 Aliases GHSA-86mr-6m89-vgj3

Buffer Overflow in node-weakauras-parser

Priority LOW 38CWE-120Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems. ## Recommendation Upgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.

Why it matters now

Fix Fixed node-weakauras-parser (npm): 1.0.5, 2.0.2, 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—node-weakauras-parser (npm)1.0.4 to before 1.0.51.0.5Patch availableGHSA-86mr-6m89-vgj3
—node-weakauras-parser (npm)2.0.0 to before 2.0.22.0.2Patch availableGHSA-86mr-6m89-vgj3
—node-weakauras-parser (npm)3.0.0 to before 3.0.13.0.1Patch availableGHSA-86mr-6m89-vgj3
  • node-weakauras-parser (npm) Vendor— Affected 1.0.4 to before 1.0.5 Fixed in 1.0.5 Patch available GHSA-86mr-6m89-vgj3
  • node-weakauras-parser (npm) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-86mr-6m89-vgj3
  • node-weakauras-parser (npm) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-86mr-6m89-vgj3

Remediation

  • Fix · GHSA-86mr-6m89-vgj3 node-weakauras-parser (npm) Fixed in 1.0.5 Advisory →
  • Fix · GHSA-86mr-6m89-vgj3 node-weakauras-parser (npm) Fixed in 2.0.2 Advisory →
  • Fix · GHSA-86mr-6m89-vgj3 node-weakauras-parser (npm) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-86mr-6m89-vgj3

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences