{"id":"GHSA-rvg8-pwq2-xj7q","aliases":["CLSA-2026-1773533799","ROOT-APP-NPM-GHSA-rvg8-pwq2-xj7q"],"status":"published","title":"Out-of-bounds Read in base64url","description":"Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-09-01T20:42:44Z","modified":"2026-10-15T09:47:28Z","fixes":[{"ecosystem":"npm","package":"base64url","fixed_in":["3.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"base64url","fixed_in":["0.0.6-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/base64url","fixed_in":["0.0.6-root.io.2","0.0.6-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"base64url","fixed_in":["0.0.6-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"base64url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"base64url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.6-tuxcare.0"},{"fixed":"0.0.6-tuxcare.1"}]}],"versions":["0.0.6"]},{"source":"osv","ecosystem":"npm","package":"base64url","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/base64url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6-root.io.2"},{"fixed":"0.0.6-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"base64url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.6-aikido.3"}]}]}],"references":[{"url":"https://hackerone.com/reports/321687","tags":["web"]},{"url":"https://github.com/brianloveswords/base64url/pull/25","tags":["web"]},{"url":"https://github.com/brianloveswords/base64url/commit/4fbd954a0a69e9d898de2146557cc6e893e79542","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rvg8-pwq2-xj7q"},{"url":"https://github.com/brianloveswords/base64url","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-rvg8-pwq2-xj7q","title":"Out-of-bounds Read in base64url","description":"Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.","status":"published","published":"2020-09-01T20:42:44Z","modified":"2023-04-21T19:31:19Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"osv":[{"id":"CLSA-2026-1773533799","title":"TuxCare security update for base64url (1 CVE)","description":"TuxCare rebuilt base64url to address 1 CVE. Fixed in 0.0.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.332675108Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"GHSA-rvg8-pwq2-xj7q","title":"Out-of-bounds Read in base64url","description":"Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.","status":"published","published":"2020-09-01T20:42:44Z","modified":"2021-09-24T20:34:56Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"ROOT-APP-NPM-GHSA-rvg8-pwq2-xj7q","title":"GHSA-rvg8-pwq2-xj7q in @rootio/base64url - Patched by Root","description":"Root has patched GHSA-rvg8-pwq2-xj7q in the @rootio/base64url package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T18:10:41Z","modified":"2026-06-05T01:30:48.228518951Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}