CVE-2018-3745
Out-of-bounds Read in atob
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
- Record
CVE-2018-3745- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
- Record
CVE-2018-3745- Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2018-0556 No score
atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
- Record
EUVD-2018-0556- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8w4h-3cm3-2pm2
Out-of-bounds Read in atob
Versions of atob before 2.1.0 uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Recommendation
Update to version 2.1.0 or later.
- Record
GHSA-8w4h-3cm3-2pm2- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVGHSA-8w4h-3cm3-2pm2
Out-of-bounds Read in atob
Versions of atob before 2.1.0 uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Recommendation
Update to version 2.1.0 or later.
- Record
GHSA-8w4h-3cm3-2pm2- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
atobnpm |
before 2.1.0 | 2.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-3745 is a critical vulnerability (CVSS 9.1) in Atob Project Atob, published May 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in atob 2.1.0.