p PatchFirst

CVE-2014-5256

CVE-2014-5256

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.

EPSS 3.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nodejs Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.10.38~dfsg-1

    Update to 0.10.38~dfsg-1

  • nodejs Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.10.38~dfsg-1

    Update to 0.10.38~dfsg-1

  • nodejs Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.10.38~dfsg-1

    Update to 0.10.38~dfsg-1

  • libv8-3.14 Ubuntu:16.04:LTS

    Versions
    • 3.14.5.8-5ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libv8-3.14 Ubuntu:18.04:LTS

    Versions
    • 3.14.5.8-11ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →