{"id":"GHSA-3p92-886g-qxpq","aliases":[],"status":"published","title":"Remote Memory Exposure in floody","description":"Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.\n\n.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.\n\nProof of Concept: \n\n```\nvar f = require('floody')(process.stdout); \nf.write(USERSUPPLIEDINPUT); \n'f.stop();\n\n\n## Recommendation\n\nUpdate to version 0.1.1 or later.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-201"],"published":"2019-06-04T15:42:32Z","modified":"2023-01-09T05:01:42Z","fixes":[{"ecosystem":"npm","package":"floody","fixed_in":["0.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"floody","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"floody","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]}],"references":[{"url":"https://github.com/soldair/node-floody/commit/6c44722312131f4ac8a1af40f0f861c85efe01b0","tags":["web"]},{"url":"https://www.npmjs.com/advisories/601","tags":["web"]},{"url":"https://snyk.io/vuln/npm:floody:20160115","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3p92-886g-qxpq"}],"sources":{"ghsa":[{"id":"GHSA-3p92-886g-qxpq","title":"Remote Memory Exposure in floody","description":"Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.\n\n.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.\n\nProof of Concept: \n\n```\nvar f = require('floody')(process.stdout); \nf.write(USERSUPPLIEDINPUT); \n'f.stop();\n\n\n## Recommendation\n\nUpdate to version 0.1.1 or later.","status":"published","published":"2019-06-04T15:42:32Z","modified":"2023-01-09T05:01:42Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-3p92-886g-qxpq","title":"Remote Memory Exposure in floody","description":"Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.\n\n.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.\n\nProof of Concept: \n\n```\nvar f = require('floody')(process.stdout); \nf.write(USERSUPPLIEDINPUT); \n'f.stop();\n\n\n## Recommendation\n\nUpdate to version 0.1.1 or later.","status":"published","published":"2019-06-04T15:42:32Z","modified":"2021-08-04T21:27:04Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}