Skip to content
OpenAdvisories
High · 7.5 CVE-2021-39131 EUVD-2021-1506GHSA-27wq-qx3q-fxm9

Improper Handling of Unexpected Data Type in ced

Published Aug 17, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.

Affected products

VendorProductAffectedFixed
sonicdoe ced < 1.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm ced < 1.0.0 1.0.0 GHSA-27wq-qx3q-fxm9

References