CVE-2018-7166: nodejs node.js
Vulnerability summary
CVE-2018-7166 is a high (CVSS 7.5) vulnerability in nodejs node.js. EPSS estimates a 3.29% chance of exploitation in the next 30 days, higher than 88.4% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 21-08-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
3.29%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
Increase +0.50 pp
From 2.79% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-226Sensitive Information in Resource Not Removed Before ReuseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
- CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
- rh-nodejs10-nodejs< 0:10.10.0-3.el7
- rh-nodejs10-nodejs-debuginfo< 0:10.10.0-3.el7
- rh-nodejs10-nodejs-devel< 0:10.10.0-3.el7
- rh-nodejs10-nodejs-docs< 0:10.10.0-3.el7
- rh-nodejs10-npm< 0:6.4.1-10.10.0.3.el7
Nodejs1 product
- node.js≥ 10.0.0, < 10.9.0
The node.js project1 product
- node.jsAll versions of Node.js 10 prior to 10.9.0
3 vendors · 7 products
