GHSA-rvg8-pwq2-xj7q
Out-of-bounds Read in base64url
GHSA-rvg8-pwq2-xj7q is a vulnerability with no CVSS score yet in base64url, published September 1, 2020. No source lists public exploit code. Fixed in base64url 3.0.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.0base64url +3 more
Description
Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Recommendation
Update to version 3.0.0 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
base64urlnpm | before 3.0.0 | 3.0.0 |
base64urlTuxCare:npm | 0.0.6-tuxcare.0 up to 0.0.6-tuxcare.1, plus listed versions 0.0.6 | 0.0.6-tuxcare.1 |
@rootio/base64urlRoot:npm | before 0.0.6-root.io.2 | 0.0.6-root.io.20.0.6-root.io.3 |
base64urlRoot:npm | before 0.0.6-aikido.3 | 0.0.6-aikido.3 |
What each source reports
GitHub AdvisoriesNo score
Out-of-bounds Read in base64url
Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Recommendation
Update to version 3.0.0 or later.
- Record
GHSA-rvg8-pwq2-xj7q- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVCLSA-2026-1773533799No score
TuxCare security update for base64url (1 CVE)
TuxCare rebuilt base64url to address 1 CVE. Fixed in 0.0.6-tuxcare.1.
- Record
CLSA-2026-1773533799- Updated
- 2026-11-02
OSVNo score
Out-of-bounds Read in base64url
Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.
Recommendation
Update to version 3.0.0 or later.
- Record
GHSA-rvg8-pwq2-xj7q- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-rvg8-pwq2-xj7qNo score
GHSA-rvg8-pwq2-xj7q in @rootio/base64url - Patched by Root
Root has patched GHSA-rvg8-pwq2-xj7q in the @rootio/base64url package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-rvg8-pwq2-xj7q- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.