GHSA-j4mr-9xw3-c9jx
Out-of-bounds Read in base64-url
GHSA-j4mr-9xw3-c9jx is a vulnerability with no CVSS score yet in base64-url, published May 31, 2019. No source lists public exploit code. Fixed in base64-url 2.0.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.0base64-url +1 more
Description
Versions of base64-url before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.
Recommendation
Update to version 2.0.0 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
base64-urlnpm | before 2.0.0 | 2.0.0 |
base64-urlTuxCare:npm | 1.2.1-tuxcare.0 up to 1.2.1-tuxcare.1, plus listed versions 1.2.1 | 1.2.1-tuxcare.1 |
What each source reports
GitHub AdvisoriesNo score
Out-of-bounds Read in base64-url
Versions of base64-url before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.
Recommendation
Update to version 2.0.0 or later.
- Record
GHSA-j4mr-9xw3-c9jx- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVCLSA-2026-1773533798No score
TuxCare security update for base64-url (1 CVE)
TuxCare rebuilt base64-url to address 1 CVE. Fixed in 1.2.1-tuxcare.1.
- Record
CLSA-2026-1773533798- Updated
- 2026-11-02
OSVNo score
Out-of-bounds Read in base64-url
Versions of base64-url before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.
Recommendation
Update to version 2.0.0 or later.
- Record
GHSA-j4mr-9xw3-c9jx- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-j4mr-9xw3-c9jxNo score
GHSA-j4mr-9xw3-c9jx in base64-url - Patched by Root
Root has patched GHSA-j4mr-9xw3-c9jx in the base64-url package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-j4mr-9xw3-c9jx- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.