{"id":"CVE-2014-5256","aliases":["DEBIAN-CVE-2014-5256","EUVD-2014-5149","GHSA-7wxw-9v42-w9g6","MGASA-2014-0516","RHSA-2014:1744","UBUNTU-CVE-2014-5256"],"status":"published","title":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive...","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03292,"percentile":0.88577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-09-05T17:00:00Z","modified":"2026-10-23T15:47:35Z","fixes":[{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["0.10.38~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["0.10.38~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["0.10.38~dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.38~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.38~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.38~dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.33-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"v8314-v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"v8314-v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"v8314-v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"v8314-v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"v8314-v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el7","package":"v8314-v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libv8-3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.5.8-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libv8-3.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.5.8-11ubuntu1"]}],"products":[{"vendor":"nodejs","product":"nodejs"}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21684769","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/61260","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://advisories.mageia.org/MGASA-2014-0516.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:142","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5256","tags":["advisory"]},{"url":"http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow"},{"url":"https://github.com/advisories/GHSA-7wxw-9v42-w9g6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5256","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0516.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13383","tags":["report"]},{"url":"http://nodejs.org/dist/v0.10.33/docs/changelog.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136333.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1744","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1059070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1074737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1077136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1125464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1149781","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1744.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6639","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6639","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6650","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6668","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6668","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-1704","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1704","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-5256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5256","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2014-5256","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5256","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2014-09-05T17:00:00Z","modified":"2024-08-06T11:41:48.492Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5149","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2014-09-05T17:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-7wxw-9v42-w9g6","title":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive...","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2022-05-17T04:13:18Z","modified":"2025-04-12T12:38:16Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-5256","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2014-09-05T17:55:07.283Z","modified":"2026-06-17T00:11:17.1Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:55.540337Z"}],"osv":[{"id":"CVE-2014-5256","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2014-09-05T17:55:07Z","modified":"2026-04-16T06:24:29.166429026Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5256","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2014-09-05T17:55:07.283Z","modified":"2026-10-23T15:47:35.732106688Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0516","title":"Updated nodejs package fixes security vulnerabilities","description":"Updated nodejs package fixes security vulnerabilities:\n\nA memory corruption vulnerability, which results in a denial-of-service, was\nidentified in the versions of V8 that ship with Node.js 0.8 and 0.10. In\ncertain circumstances, a particularly deep recursive workload that may trigger\na GC and receive an interrupt may overflow the stack and result in a\nsegmentation fault. For instance, if your work load involves successive\nJSON.parse calls and the parsed objects are significantly deep, you may\nexperience the process aborting while parsing (CVE-2014-5256).\n\nMultiple unspecified vulnerabilities in Google V8 before 3.24.35.10, as used\nin Node.js before 0.10.31, allow attackers to cause a denial of service or\npossibly have other impact via unknown vectors (CVE-2013-6668).\n\nThe nodejs package has been updated to version 0.10.33 to fix these issues\nas well as several other bugs.\n","status":"published","published":"2014-12-09T20:12:41Z","modified":"2026-04-16T06:25:17.860245559Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2014:1744","title":"Red Hat Security Advisory: v8314-v8 security update","status":"published","published":"2024-09-13T09:20:37Z","modified":"2026-06-29T10:07:41Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-5256","description":"Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.","status":"published","published":"2014-09-05T17:55:00Z","modified":"2026-04-22T09:46:33.553961Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}