{"id":"CVE-2018-21270","aliases":["CLSA-2026-1772583200","CLSA-2026-1773274557","DEBIAN-CVE-2018-21270","EUVD-2019-0549","GHSA-mf6x-7mm4-x2g7","UBUNTU-CVE-2018-21270"],"status":"published","title":"Out-of-bounds Read in stringstream","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03682,"percentile":0.89765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-06-20T18:22:32Z","modified":"2026-10-24T10:49:40Z","fixes":[{"ecosystem":"npm","package":"stringstream","fixed_in":["0.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"stringstream","fixed_in":["0.0.5-tuxcare.1","0.0.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-stringstream","fixed_in":["0.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-stringstream","fixed_in":["0.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-stringstream","fixed_in":["0.0.6-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.5-tuxcare.0"},{"fixed":"0.0.5-tuxcare.1"}]}],"versions":["0.0.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.4-tuxcare.0"},{"fixed":"0.0.4-tuxcare.1"}]}],"versions":["0.0.4"]},{"source":"osv","ecosystem":"Debian:12","package":"node-stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6-1"}]}]},{"source":"osv","ecosystem":"npm","package":"stringstream","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-stringstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.5-1"]}],"products":[{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://hackerone.com/reports/321670","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://www.npmjs.com/advisories/664","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/mhart/StringStream/issues/7","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/mhart/StringStream/blob/v0.0.5/stringstream.js#L32","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mf6x-7mm4-x2g7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-21270","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-21270","tags":["report"]},{"url":"https://github.com/mhart/StringStream/commit/afbc7442220358419e330618e47f3a65fc265b1b","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-21270","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-21270","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","status":"published","published":"2020-12-03T21:00:45Z","modified":"2024-08-05T12:26:39.596Z","updated_at":"2026-11-02T14:35:02.289647Z"}],"euvd":[{"id":"EUVD-2019-0549","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","status":"published","published":"2020-12-03T21:00:45Z","modified":"2024-08-05T12:26:39Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-mf6x-7mm4-x2g7","title":"Out-of-bounds Read in stringstream","description":"All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.","status":"published","published":"2019-06-20T18:22:32Z","modified":"2023-02-01T05:02:20Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:30.61364Z"}],"nvd":[{"id":"CVE-2018-21270","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","status":"published","published":"2020-12-03T21:15:11.1Z","modified":"2026-06-17T01:54:30.263Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:00.03074Z"}],"osv":[{"id":"CVE-2018-21270","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","status":"published","published":"2020-12-03T21:15:11.1Z","modified":"2026-10-24T10:49:40.834863904Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-21270","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","status":"published","published":"2020-12-03T21:15:11.1Z","modified":"2026-10-23T18:03:05.986936117Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-21270","description":"Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).","status":"published","published":"2020-12-03T21:15:00Z","modified":"2025-10-24T04:47:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"CLSA-2026-1772583200","title":"TuxCare security update for stringstream (1 CVE)","description":"TuxCare rebuilt stringstream to address 1 CVE. Fixed in 0.0.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:46:59.60756884Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773274557","title":"TuxCare security update for stringstream (1 CVE)","description":"TuxCare rebuilt stringstream to address 1 CVE. Fixed in 0.0.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:27.943708035Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"GHSA-mf6x-7mm4-x2g7","title":"Out-of-bounds Read in stringstream","description":"All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.\n\n\n## Recommendation\n\nNo fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.","status":"published","published":"2019-06-20T18:22:32Z","modified":"2023-11-08T04:00:14.605779Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}