Description
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Node.js Project | Node.js | 8.0 and higher, 9.0 and higher | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs | 8.9.3-r0 | — |
| Alpine v3.24 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.23 | nodejs | 8.9.3-r0 | — |
| Alpine v3.23 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.22 | nodejs | 8.9.3-r0 | — |
| Alpine v3.22 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.21 | nodejs | 8.9.3-r0 | — |
| Alpine v3.21 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.20 | nodejs | 8.9.3-r0 | — |
| Alpine v3.20 | nodejs-current | 9.2.1-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs | 8.9.3-r0 | — |
| Alpine v3.19 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.18 | nodejs | 8.9.3-r0 | — |
| Alpine v3.18 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.17 | nodejs | 8.9.3-r0 | — |
| Alpine v3.17 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.16 | nodejs | 8.9.3-r0 | — |
| Alpine v3.16 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.15 | nodejs | 8.9.3-r0 | — |
| Alpine v3.15 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.14 | nodejs | 8.9.3-r0 | — |
| Alpine v3.14 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.13 | nodejs | 8.9.3-r0 | — |
| Alpine v3.13 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.12 | nodejs | 8.9.3-r0 | — |
| Alpine v3.12 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.11 | nodejs | 8.9.3-r0 | — |
| Alpine v3.11 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.10 | nodejs | 8.9.3-r0 | — |
| Alpine v3.10 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.9 | nodejs | 8.9.3-r0 | — |
| Alpine v3.9 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.8 | nodejs | 8.9.3-r0 | — |
| Alpine v3.8 | nodejs-current | 9.2.1-r0 | — |
| Alpine v3.7 | nodejs | 8.9.3-r0 | — |
| Alpine v3.7 | nodejs-current | 9.2.1-r0 | — |
Advisories 1
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026