CVE-2020-8252: The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• nodejs node.js10.0.0 and later · before 10.22.1
• nodejs node.js12.0.0 and later · before 12.18.4
• nodejs node.js14.0.0 and later · before 14.9.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• NodeJS Node

  • 4.0 and later · before 4.*affected · semver
  • 5.0 and later · before 5.*affected · semver
  • 6.0 and later · before 6.*affected · semver
  • 7.0 and later · before 7.*affected · semver
  • 8.0 and later · before 8.*affected · semver
  • 9.0 and later · before 9.*affected · semver
  • 10.0 and later · before 10.22.1affected · semver
  • 11.0 and later · before 11.*affected · semver
  • 12.0 and later · before 12.18.4affected · semver
  • 13.0 and later · before 13.*affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
  56Plan
• CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an
  53Plan
• CVE-2021-22930Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c
  50Plan

Published before and after this one in the same product

• ← EarlierCVE-2020-8201Sep 18, 2020 · Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.
  31Monitor
• ← EarlierCVE-2020-8251Sep 18, 2020 · Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unabl
  33Monitor
• Later →CVE-2020-8277Nov 18, 2020 · A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versi
  46Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.